|
|
TCP |
31175 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:31175 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31175
Chemin / cible
—
Service
TLS
Payload
� ������"�6c! �|�|:�M����S�Ԉ� �Te�=�������%r�d)��Z$wT�Y���� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������"�6c!
�|�|:�M����S�Ԉ� �Te�=�������%r�d)��Z$wT�Y���� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ������"�6c! �|�|:�M����S�Ԉ� �Te�=�������%r�d)��Z$wT�Y���� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �E�99���{ޠSLn\�1u "��� CD�wig
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.843956803534107,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "74a5051c60e3a0ca44a1d257ca09c34c86ef79df",
"event_fingerprint": "11400882dd034dbec026f56598cba332c9723622",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "d565e03c7f83d00b43da422f862d3dc6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 31175,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0017\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd\u000f \u000e\ufffdT\u001be\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\b\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0017\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd\u000f \u000e\ufffdT\u001be\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\b\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdE\ufffd99\ufffd\u0003\ufffd\ufffd{\u07a0SL\u0014n\\\ufffd1u\u0000\"\ufffd\ufffd\ufffd\u000bCD\ufffdwig",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0017\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd\u000f \u000e\ufffdT\u001be\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\b\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d04015a30e0aaca4d28c8c2870225e57e9505f36",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0017\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd\u000f \u000e\ufffdT\u001be\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\b\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd \ufffdTe\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0017\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd\u000f \u000e\ufffdT\u001be\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\b\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd6c!\r\ufffd|\ufffd|:\ufffdM\ufffd\ufffd\ufffd\ufffdS\ufffd\u0508\ufffd \ufffdTe\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%r\ufffdd)\ufffd\ufffdZ$wT\ufffdY\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
31175 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:31175 · (sonde / probe) · → /security.txt
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /security.txt UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/security.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
31175
Chemin / cible
/security.txt
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Scanner Censys
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /security.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /security.txt HTTP/1.1
Host: 62.3.50.33:31175
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censy
Requête brute (extrait)
GET /security.txt HTTP/1.1 Host: 62.3.50.33:31175 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "2291bebc3dc9fb6af56a3b2289200d466184e55d",
"http_target_hash": "35388aa39f105600011ad0e7ab2a90933c84d4f3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 174,
"payload_entropy": 5.172664256634255,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 67.5,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c833ee3c868b03dcee0c2fe7e7dd4f04adc8980c",
"event_fingerprint": "517c4acac9e363a9d4525cb01d9c06a08b45e927",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 115,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "7c41801311996f6cac75beb4bf644be6",
"path_pattern_hash": "46dad10a99f0d5a132ae4c1e64099a4b"
},
"target_context": {
"dst_port": 31175,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censy",
"method": "GET",
"path": "\/security.txt",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/security.txt HTTP\/1.1",
"request_sample": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censy",
"evidence": {
"method": "GET",
"path": "\/security.txt",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/security.txt HTTP\/1.1",
"request_sample": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censy",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "172013b85bee3dfc72d2f8ae75b16b05078c9b5b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/security.txt",
"request_line": "GET \/security.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censy",
"attack_vector": "web scanner \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/security.txt",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/security.txt",
"request_line": "GET \/security.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/security.txt",
"evidence_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censy",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
31175 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:31175 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31175
Chemin / cible
—
Service
TLS
Payload
� ���Y}:Z�v����g�si��GZ��3"qUiF Z6@RԚ6�b��0�DI�=@| �y$b*(2�a� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���Y}:Z�v����g�si��GZ��3"qUiF Z6@RԚ6�b��0�DI�=@| �y$b*(2�a� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���Y}:Z�v����g�si��GZ��3"qUiF Z6@RԚ6�b��0�DI�=@| �y$b*(2�a� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ s.��??� ,���R �A�XK�:¢���<y
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.851681276552978,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "74a5051c60e3a0ca44a1d257ca09c34c86ef79df",
"event_fingerprint": "11400882dd034dbec026f56598cba332c9723622",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "648aaffe85358e223653c49001bb846f",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 31175,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdY}:Z\ufffdv\ufffd\u000f\ufffd\ufffd\ufffd\u0016g\ufffdsi\ufffd\ufffdG\u0012Z\u0015\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=\u001b@|\u0011\u001d\ufffdy$b*(2\ufffda\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdY}:Z\ufffdv\ufffd\u000f\ufffd\ufffd\ufffd\u0016g\ufffdsi\ufffd\ufffdG\u0012Z\u0015\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=\u001b@|\u0011\u001d\ufffdy$b*(2\ufffda\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 s.\ufffd\ufffd?\u0016?\ufffd\u001e,\ufffd\ufffd\ufffdR\u0000\ufffdA\ufffdXK\ufffd:\u00a2\u0001\u000f\ufffd\ufffd\u0007\ufffd<y",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdY}:Z\ufffdv\ufffd\u000f\ufffd\ufffd\ufffd\u0016g\ufffdsi\ufffd\ufffdG\u0012Z\u0015\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=\u001b@|\u0011\u001d\ufffdy$b*(2\ufffda\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4001bf432202edc473c65c4f3d78f40247723e4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdY}:Z\ufffdv\ufffd\u000f\ufffd\ufffd\ufffd\u0016g\ufffdsi\ufffd\ufffdG\u0012Z\u0015\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=\u001b@|\u0011\u001d\ufffdy$b*(2\ufffda\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY}:Z\ufffdv\ufffd\ufffd\ufffd\ufffdg\ufffdsi\ufffd\ufffdGZ\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=@|\ufffdy$b*(2\ufffda\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdY}:Z\ufffdv\ufffd\u000f\ufffd\ufffd\ufffd\u0016g\ufffdsi\ufffd\ufffdG\u0012Z\u0015\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=\u001b@|\u0011\u001d\ufffdy$b*(2\ufffda\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY}:Z\ufffdv\ufffd\ufffd\ufffd\ufffdg\ufffdsi\ufffd\ufffdGZ\ufffd\ufffd3\"qUiF Z6@R\u051a6\ufffdb\ufffd\ufffd0\ufffdDI\ufffd=@|\ufffdy$b*(2\ufffda\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
31175 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:31175 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
31175
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:31175
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Acce
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:31175 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "2291bebc3dc9fb6af56a3b2289200d466184e55d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 162,
"payload_entropy": 5.168454690886672,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "aceeaf691a9bf46aa2515db35074208881b2f62a",
"event_fingerprint": "ea056fea23aed02f7772ad3c1d3bbd5c5393d630",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "1182905028035a5dba360c2669323425",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 31175,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf633b0038a423516eb03f6693226fb93e6afab2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"attack_vector": "web scanner \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
31175 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:31175 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
31175
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "47b047b41af6e15856745d20bb6a6c97d72dd713",
"event_fingerprint": "e45e1f6501f33471ebd2c84aad8276e015d6191d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 31175,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cc67e372a2c9cf3f1c1aad640e45747476884cc",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
]
}
|
|
|
TCP |
31175 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:31175 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
8
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
951040:websocket-anomaly
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
31175
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 40 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
websocket-anomaly
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:31175
Connection: Upgrade
Sec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==
Sec-WebSocket-Version:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:31175 Connection: Upgrade Sec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A== Sec-WebSocket-Version: 13 Upgrade: websocket
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "2291bebc3dc9fb6af56a3b2289200d466184e55d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 155,
"payload_entropy": 5.286599198331044,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 40,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "62403e64ca34eb8c85501f3794380e6f41650d74",
"event_fingerprint": "89280f15626860b20c5fb0dbe850a766adf8f662",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29cdf64b9e75ab4350510184804bb981",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 31175,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version:",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version:",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version:",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e56c49d91e04bbfe679f31aa147ade6bac0bf85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version:",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 31175,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31175\r\nConnection: Upgrade\r\nSec-WebSocket-Key: aQci3qYxoaqpG+DjD3OY2A==\r\nSec-WebSocket-Version:",
"target_port_label": "31175 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly",
"http_no_ua"
]
}
|
|
|
TCP |
31175 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:31175 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31175
Chemin / cible
—
Service
TLS
Payload
� �w{C(֕�nm�s�y1��U�4�b;/yO��i�� �b���#����鈟�Ш U��;Ѽ�0g�U� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �w{C(֕�nm�s�y1��U�4�b;/yO��i�� �b���#����鈟�Ш U��;Ѽ�0g�U� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �w{C(֕�nm�s�y1��U�4�b;/yO��i�� �b���#����鈟�Ш U��;Ѽ�0g�U� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ j���n�EL�).>l" �%s���*����.
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.832144543163369,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "74a5051c60e3a0ca44a1d257ca09c34c86ef79df",
"event_fingerprint": "11400882dd034dbec026f56598cba332c9723622",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "ec4569acc5c68b9abd5c5086c5704dc4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 31175,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003w{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\u0002\ufffdb;\/yO\ufffd\u001b\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\u0011\ufffd\u0018\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd\u00020g\ufffdU\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003w{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\u0002\ufffdb;\/yO\ufffd\u001b\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\u0011\ufffd\u0018\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd\u00020g\ufffdU\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 j\ufffd\ufffd\ufffdn\u0019\ufffdEL\ufffd).>l\"\r\ufffd%\u0011s\ufffd\ufffd\u0018\ufffd*\ufffd\ufffd\ufffd\ufffd.\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003w{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\u0002\ufffdb;\/yO\ufffd\u001b\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\u0011\ufffd\u0018\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd\u00020g\ufffdU\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "392f0b439ab057c180d44d3a665bbbdec1c004be",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003w{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\u0002\ufffdb;\/yO\ufffd\u001b\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\u0011\ufffd\u0018\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd\u00020g\ufffdU\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdw{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\ufffdb;\/yO\ufffd\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd0g\ufffdU\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003w{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\u0002\ufffdb;\/yO\ufffd\u001b\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\u0011\ufffd\u0018\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd\u00020g\ufffdU\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31175,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdw{C(\u0595\ufffdnm\ufffds\ufffdy1\ufffd\ufffdU\ufffd4\ufffdb;\/yO\ufffd\ufffdi\ufffd\ufffd \ufffdb\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\u921f\ufffd\u0428\tU\ufffd\ufffd;\u047c\ufffd0g\ufffdU\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "31175 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:31175",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
31175
|
—
|
Sonde port
Sonde port · port 31175 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
31175
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 31175,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4011868269fbe1b6500bc4811f14c0e9136dfea8",
"event_fingerprint": "afe40da4bef51f17c15a854ebe18049aca5fb19a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 31175,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9784de93c22aecf336b912c6ab4159ed675591bb",
"protocol_details": {
"port": 31175
},
"attack_vector": "Sonde port \u00b7 port 31175 \u00b7 (sonde \/ probe)",
"target_port_label": "31175",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 31175,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 31175
},
"attack_vector": "Sonde port \u00b7 port 31175 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "31175",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "31175"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
32456 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:32456 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32456
Chemin / cible
—
Service
TLS
Payload
� ���tx��D k�Q�� ��ۖe|���� 8`;zk� I9D�ej� ݅�d����C���b���OA� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���tx��D k�Q�� ��ۖe|���� 8`;zk� I9D�ej�
݅�d����C���b���OA� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���tx��D k�Q�� ��ۖe|���� 8`;zk� I9D�ej� ݅�d����C���b���OA� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ zj�I��f3Δbc&��J٠N���oч^�O
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.894839814490763,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0541c435ecd93bac51a58f675d751c0d4697270d",
"event_fingerprint": "6c6d173bbf9fbf6c84a48dcfd2f30752260f31f2",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "da267dd338049e6713d654405c414b29",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 32456,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdtx\ufffd\ufffdD\u001dk\ufffdQ\ufffd\ufffd\u001c\ufffd\ufffd\u06d6\u0011e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\u0012\u0019\r\u0745\ufffdd\ufffd\ufffd\u0019\ufffd\ufffdC\u0003\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdtx\ufffd\ufffdD\u001dk\ufffdQ\ufffd\ufffd\u001c\ufffd\ufffd\u06d6\u0011e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\u0012\u0019\r\u0745\ufffdd\ufffd\ufffd\u0019\ufffd\ufffdC\u0003\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 zj\ufffdI\ufffd\ufffdf3\u0394bc&\ufffd\ufffdJ\u000e\u0660\u0004N\ufffd\ufffd\ufffdo\u0447^\ufffdO",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdtx\ufffd\ufffdD\u001dk\ufffdQ\ufffd\ufffd\u001c\ufffd\ufffd\u06d6\u0011e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\u0012\u0019\r\u0745\ufffdd\ufffd\ufffd\u0019\ufffd\ufffdC\u0003\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e5c805512377b850732544ee725bb67df87c74",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdtx\ufffd\ufffdD\u001dk\ufffdQ\ufffd\ufffd\u001c\ufffd\ufffd\u06d6\u0011e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\u0012\u0019\r\u0745\ufffdd\ufffd\ufffd\u0019\ufffd\ufffdC\u0003\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdtx\ufffd\ufffdDk\ufffdQ\ufffd\ufffd\ufffd\ufffd\u06d6e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\r\u0745\ufffdd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdtx\ufffd\ufffdD\u001dk\ufffdQ\ufffd\ufffd\u001c\ufffd\ufffd\u06d6\u0011e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\u0012\u0019\r\u0745\ufffdd\ufffd\ufffd\u0019\ufffd\ufffdC\u0003\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdtx\ufffd\ufffdDk\ufffdQ\ufffd\ufffd\ufffd\ufffd\u06d6e|\ufffd\ufffd\ufffd\ufffd\t8`;zk\ufffd I9D\ufffdej\ufffd\r\u0745\ufffdd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdOA\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
32456 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:32456 · (sonde / probe) · → /wiki
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /wiki UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/wiki
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
32456
Chemin / cible
/wiki
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /wiki HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /wiki HTTP/1.1
Host: 62.3.50.33:32456
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Requête brute (extrait)
GET /wiki HTTP/1.1 Host: 62.3.50.33:32456 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "37750619fe92202d251c6d8b4caaa36db20d2009",
"http_target_hash": "6e19ef03648d0e0a22ed0f7ad0be4e265e7c7c3f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 166,
"payload_entropy": 5.228665277616157,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 67.5,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.5,
"risk_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5124b1a4bf9ccee2014e0d0f75e9527ecc994c0c",
"event_fingerprint": "3ab9d2d04277e9e9da3d20722e108b2c15050f7d",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "fca8fa5ca213238e08b68765532d81fc",
"path_pattern_hash": "fdf33dfda1bc755bf3cc3020003e45ff"
},
"target_context": {
"dst_port": 32456,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\n",
"method": "GET",
"path": "\/wiki",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/wiki HTTP\/1.1",
"request_sample": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"evidence": {
"method": "GET",
"path": "\/wiki",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/wiki HTTP\/1.1",
"request_sample": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc9f69a15bd6d746d9199b1ad216c366c385a7ac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wiki",
"request_line": "GET \/wiki HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"attack_vector": "web scanner \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/wiki",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wiki",
"request_line": "GET \/wiki HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/wiki",
"evidence_snippet": "GET \/wiki HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
32456 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:32456 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32456
Chemin / cible
—
Service
TLS
Payload
� �ϸ<���p�zpj��."�\e�c�bK�䠾_x V��`J�Ⱦ.�ys5m� ���K�Sċ9z�q� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ϸ<���p�zpj��."�\e�c�bK�䠾_x V��`J�Ⱦ.�ys5m� ���K�Sċ9z�q� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �ϸ<���p�zpj��."�\e�c�bK�䠾_x V��`J�Ⱦ.�ys5m� ���K�Sċ9z�q� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���S&����O7�`65ޚ/�4cݪ�!�,
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.841250127366021,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0541c435ecd93bac51a58f675d751c0d4697270d",
"event_fingerprint": "6c6d173bbf9fbf6c84a48dcfd2f30752260f31f2",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "15eb8086b25b88d8115ba3bcce619433",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 32456,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u03f8<\ufffd\ufffd\ufffdp\ufffd\u0014zpj\u0012\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`\u0017J\ufffd\u023e.\ufffdys5m\ufffd\u0012\u001d\ufffd\u0019\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u03f8<\ufffd\ufffd\ufffdp\ufffd\u0014zpj\u0012\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`\u0017J\ufffd\u023e.\ufffdys5m\ufffd\u0012\u001d\ufffd\u0019\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0001\ufffd\u0006\ufffdS&\b\ufffd\ufffd\u001a\ufffd\ufffdO7\ufffd`65\u079a\/\ufffd4\u0011c\u076a\ufffd!\ufffd,",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u03f8<\ufffd\ufffd\ufffdp\ufffd\u0014zpj\u0012\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`\u0017J\ufffd\u023e.\ufffdys5m\ufffd\u0012\u001d\ufffd\u0019\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d27c1ac956340954afeba8325a46ed09cbe40e1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u03f8<\ufffd\ufffd\ufffdp\ufffd\u0014zpj\u0012\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`\u0017J\ufffd\u023e.\ufffdys5m\ufffd\u0012\u001d\ufffd\u0019\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u03f8<\ufffd\ufffd\ufffdp\ufffdzpj\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`J\ufffd\u023e.\ufffdys5m\ufffd\ufffd\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u03f8<\ufffd\ufffd\ufffdp\ufffd\u0014zpj\u0012\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`\u0017J\ufffd\u023e.\ufffdys5m\ufffd\u0012\u001d\ufffd\u0019\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u03f8<\ufffd\ufffd\ufffdp\ufffdzpj\ufffd\ufffd.\"\ufffd\\e\ufffdc\ufffdbK\ufffd\u483e_x V\ufffd\ufffd`J\ufffd\u023e.\ufffdys5m\ufffd\ufffd\ufffd\ufffdK\ufffdS\u010b9z\ufffdq\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
32456 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:32456 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
32456
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:32456
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Acce
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:32456 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "37750619fe92202d251c6d8b4caaa36db20d2009",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 162,
"payload_entropy": 5.190119968691159,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 48,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "2c5442926987b86d97f307e26c07e8d60ec5233d",
"event_fingerprint": "15607e44060ef1b9f675452c6344f08cc5a01077",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "69b4cd9d5fc62b9752d559ecfb5e99f3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 32456,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e44966b806152bdefa3061bcac9a475d0e43841a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"attack_vector": "web scanner \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
32456 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:32456 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
32456
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "86e78c474dc2bd447abc5c1199031570b0987e69",
"event_fingerprint": "692a6b08188f718996c00ae06a6dd0bb6a8100ea",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 32456,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb82cd8b65980209c856e3ab851768ca00a82ad6",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
]
}
|
|
|
TCP |
32456 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:32456 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
8
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
951040:websocket-anomaly
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
32456
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 40 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
websocket-anomaly
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:32456
Connection: Upgrade
Sec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==
Sec-WebSocket-Version:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:32456 Connection: Upgrade Sec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA== Sec-WebSocket-Version: 13 Upgrade: websocket
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "37750619fe92202d251c6d8b4caaa36db20d2009",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 155,
"payload_entropy": 5.300146717493043,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 40,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bd5d43cc6608225aca9aab9ac8f20a3ef4e8473a",
"event_fingerprint": "09374c2cf0ec12778190d51d08bf06b77283f668",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a7e597c02649adb0133b0e288a12a5d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 32456,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version:",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version:",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version:",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6af5301073d47a5ed60e9a2c599eeccb4d71cd4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version:",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 32456,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:32456\r\nConnection: Upgrade\r\nSec-WebSocket-Key: fCBt2JH+m1K2gL5gcf4BOA==\r\nSec-WebSocket-Version:",
"target_port_label": "32456 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly",
"http_no_ua"
]
}
|
|
|
TCP |
32456 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:32456 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32456
Chemin / cible
—
Service
TLS
Payload
� �/�d���z� �Iw�L��$d4$`�R9�p, %���ЂK=l���z��1�%��&>��ަ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/�d���z�
�Iw�L��$d4$`�R9�p, %���ЂK=l���z��1�%��&>��ަ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �/�d���z� �Iw�L��$d4$`�R9�p, %���ЂK=l���z��1�%��&>��ަ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���x+1 ��pGb�;�`Jn�i���j�E#
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.818801462771689,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0541c435ecd93bac51a58f675d751c0d4697270d",
"event_fingerprint": "6c6d173bbf9fbf6c84a48dcfd2f30752260f31f2",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "8004d96ee24b30f9d877d7e78be92b64",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 32456,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u000f\u000f\ufffdd\ufffd\ufffd\ufffdz\u0010\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR\u00159\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd\u00051\ufffd%\ufffd\ufffd&\u0010>\u0013\ufffd\ufffd\u07a6\u0010\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u000f\u000f\ufffdd\ufffd\ufffd\ufffdz\u0010\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR\u00159\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd\u00051\ufffd%\ufffd\ufffd&\u0010>\u0013\ufffd\ufffd\u07a6\u0010\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdx+1\r\ufffd\ufffdpGb\ufffd;\ufffd`\u001aJn\ufffd\u001ai\ufffd\ufffd\ufffdj\ufffdE\u0012#",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u000f\u000f\ufffdd\ufffd\ufffd\ufffdz\u0010\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR\u00159\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd\u00051\ufffd%\ufffd\ufffd&\u0010>\u0013\ufffd\ufffd\u07a6\u0010\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89cd059c8ed4cb22d44ad1c06454af3016f526e5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u000f\u000f\ufffdd\ufffd\ufffd\ufffdz\u0010\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR\u00159\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd\u00051\ufffd%\ufffd\ufffd&\u0010>\u0013\ufffd\ufffd\u07a6\u0010\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\/\ufffdd\ufffd\ufffd\ufffdz\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR9\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd1\ufffd%\ufffd\ufffd&>\ufffd\ufffd\u07a6\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u000f\u000f\ufffdd\ufffd\ufffd\ufffdz\u0010\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR\u00159\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd\u00051\ufffd%\ufffd\ufffd&\u0010>\u0013\ufffd\ufffd\u07a6\u0010\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 32456,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\/\ufffdd\ufffd\ufffd\ufffdz\ufffd\r\ufffdIw\ufffdL\ufffd\ufffd$d4$`\ufffdR9\ufffdp, %\ufffd\ufffd\ufffd\u0402K=l\ufffd\ufffd\ufffdz\ufffd\ufffd1\ufffd%\ufffd\ufffd&>\ufffd\ufffd\u07a6\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "32456 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:32456",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
32456
|
—
|
Sonde port
Sonde port · port 32456 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32456
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 32456,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4ad15acc1cd04120993345af5c20e8fd121dd54c",
"event_fingerprint": "2eccd42cc1410df11fbea5501e8c808a41c8027d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 32456,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2199ce168989cfad30d2681cf6bad2aba6593610",
"protocol_details": {
"port": 32456
},
"attack_vector": "Sonde port \u00b7 port 32456 \u00b7 (sonde \/ probe)",
"target_port_label": "32456",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 32456,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 32456
},
"attack_vector": "Sonde port \u00b7 port 32456 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "32456",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "32456"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
1963 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1963 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1963
Chemin / cible
—
Service
TLS
Payload
� �`�)���/R+��k��@��Jnj�A7�m�� P�` ��&:(6z��e����f#(�M�=0�(�Wj� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �`�)���/R+��k��@��Jnj�A7�m�� P�` ��&:(6z��e����f#(�M�=0�(�Wj� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �`�)���/R+��k��@��Jnj�A7�m�� P�` ��&:(6z��e����f#(�M�=0�(�Wj� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � �=�R�Ëb�]�� �.A��p�R�ضX�^8
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.90146384936499,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aec791e069ea8597c13e436b512e5a626e94c7a4",
"event_fingerprint": "7f6ca270d6562f05b62f0df1744b5d3d6371467e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "25fde09ae3ab5dda3e553612aee78fb2",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1963,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffd\u001cP\ufffd`\u001b \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\u0017f#(\ufffd\u0001M\ufffd\u0007=0\ufffd(\ufffdWj\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffd\u001cP\ufffd`\u001b \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\u0017f#(\ufffd\u0001M\ufffd\u0007=0\ufffd(\ufffdWj\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001c\ufffd=\ufffdR\ufffd\u00cbb\ufffd]\ufffd\ufffd\f\ufffd.A\u001b\ufffd\u0019\ufffdp\ufffdR\ufffd\u0636X\ufffd^8",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffd\u001cP\ufffd`\u001b \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\u0017f#(\ufffd\u0001M\ufffd\u0007=0\ufffd(\ufffdWj\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4de88c507974a2319ff865d6e45d19aa613064ba",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffd\u001cP\ufffd`\u001b \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\u0017f#(\ufffd\u0001M\ufffd\u0007=0\ufffd(\ufffdWj\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffdP\ufffd` \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdf#(\ufffdM\ufffd=0\ufffd(\ufffdWj\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffd\u001cP\ufffd`\u001b \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\u0017f#(\ufffd\u0001M\ufffd\u0007=0\ufffd(\ufffdWj\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd`\ufffd)\ufffd\ufffd\ufffd\/R+\ufffd\ufffdk\ufffd\ufffd@\ufffd\ufffdJnj\ufffdA7\ufffdm\ufffd\ufffdP\ufffd` \ufffd\ufffd&:(6z\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdf#(\ufffdM\ufffd=0\ufffd(\ufffdWj\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
1963 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:1963 · (sonde / probe) · → /sitemap.xml
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sitemap.xml UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1963
Chemin / cible
/sitemap.xml
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:1963
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.
Requête brute (extrait)
GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:1963 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "df1fa056ede7bb4d9931324d42f1394e668ba780",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 172,
"payload_entropy": 5.189776929328533,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 67.5,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "59862a5a313dd48d8e3cab64b55055ebd53a497e",
"event_fingerprint": "f4483d7f5ebdc84fe135d31d1dd5074ec0bdb739",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "1a5f4565f5dc34792f6d6248993eb7fb",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 1963,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f51858cb7fc0733e2b267c131ba4f61e21c7ab4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"attack_vector": "web scanner \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
1963 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1963 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1963
Chemin / cible
—
Service
TLS
Payload
� ��6�-�y2��1�E �as����m(5�D���}� CtpQ���-�pbW�Q}�s �����- &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��6�-�y2��1�E �as����m(5�D���}�
CtpQ���-�pbW�Q}�s �����- &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��6�-�y2��1�E �as����m(5�D���}� CtpQ���-�pbW�Q}�s �����- &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��4Q�h��#P�Y��������':��� � �*
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.833750960964038,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aec791e069ea8597c13e436b512e5a626e94c7a4",
"event_fingerprint": "7f6ca270d6562f05b62f0df1744b5d3d6371467e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "3ea3d7b362a470b474c24862b2a0beca",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1963,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd6\ufffd-\ufffdy2\ufffd\u0015\ufffd1\ufffdE\u000b\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\u0004\ufffd}\ufffd \rCt\u0015pQ\ufffd\ufffd\ufffd-\b\ufffdp\u0002bW\ufffdQ}\ufffds\u001d\b\ufffd\u0002\ufffd\ufffd\ufffd\ufffd-\u001b\u0011\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd6\ufffd-\ufffdy2\ufffd\u0015\ufffd1\ufffdE\u000b\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\u0004\ufffd}\ufffd \rCt\u0015pQ\ufffd\ufffd\ufffd-\b\ufffdp\u0002bW\ufffdQ}\ufffds\u001d\b\ufffd\u0002\ufffd\ufffd\ufffd\ufffd-\u001b\u0011\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd4Q\ufffdh\ufffd\ufffd#P\ufffdY\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd':\ufffd\ufffd\ufffd\t\ufffd\u000b\ufffd*",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd6\ufffd-\ufffdy2\ufffd\u0015\ufffd1\ufffdE\u000b\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\u0004\ufffd}\ufffd \rCt\u0015pQ\ufffd\ufffd\ufffd-\b\ufffdp\u0002bW\ufffdQ}\ufffds\u001d\b\ufffd\u0002\ufffd\ufffd\ufffd\ufffd-\u001b\u0011\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b51c64a0f0d686b0a9649b44dc3f75ec963380af",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd6\ufffd-\ufffdy2\ufffd\u0015\ufffd1\ufffdE\u000b\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\u0004\ufffd}\ufffd \rCt\u0015pQ\ufffd\ufffd\ufffd-\b\ufffdp\u0002bW\ufffdQ}\ufffds\u001d\b\ufffd\u0002\ufffd\ufffd\ufffd\ufffd-\u001b\u0011\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd6\ufffd-\ufffdy2\ufffd\ufffd1\ufffdE\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\ufffd}\ufffd \rCtpQ\ufffd\ufffd\ufffd-\ufffdpbW\ufffdQ}\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd-&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd6\ufffd-\ufffdy2\ufffd\u0015\ufffd1\ufffdE\u000b\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\u0004\ufffd}\ufffd \rCt\u0015pQ\ufffd\ufffd\ufffd-\b\ufffdp\u0002bW\ufffdQ}\ufffds\u001d\b\ufffd\u0002\ufffd\ufffd\ufffd\ufffd-\u001b\u0011\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd6\ufffd-\ufffdy2\ufffd\ufffd1\ufffdE\ufffdas\ufffd\ufffd\ufffd\ufffdm(5\ufffdD\ufffd\ufffd\ufffd}\ufffd \rCtpQ\ufffd\ufffd\ufffd-\ufffdpbW\ufffdQ}\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd-&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
1963 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:1963 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1963
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1963
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1963 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "df1fa056ede7bb4d9931324d42f1394e668ba780",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 161,
"payload_entropy": 5.174947819036265,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b0e8ce577f05611a95b1be5fe5ba699731122363",
"event_fingerprint": "9a0ce17a9eb09412323d3697c23eb1fd50cf67ec",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "a4855417ec2b77af13aa538fdec64655",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1963,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5a50f40326a5471de3e4fb36532c22eaab56a65",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"attack_vector": "web scanner \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
1963 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:1963 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
1963
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "edb4641bd7aec40a359d68f99204080ec29a8e11",
"event_fingerprint": "aded635bb75b03e9fe8720e734faf90b34d7173a",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 1963,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d6ee652734faa4db51a8c494ec3c31144136a2e",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
]
}
|
|
|
TCP |
1963 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:1963 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
8
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
951040:websocket-anomaly
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1963
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 40 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
websocket-anomaly
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1963
Connection: Upgrade
Sec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==
Sec-WebSocket-Version:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1963 Connection: Upgrade Sec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg== Sec-WebSocket-Version: 13 Upgrade: websocket
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "df1fa056ede7bb4d9931324d42f1394e668ba780",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 154,
"payload_entropy": 5.249674730844506,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 40,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a70d7b7022a76ec56c11d3666ac5f5fd4e51aa62",
"event_fingerprint": "ccd56091ac2dc2808b239025d89c22481f67d967",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f2faed64c72dfd35242605bc69d97fa6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 1963,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version: ",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version:",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version:",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c547d447424e33302517079d9b86324175e31df",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version:",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1963,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1963\r\nConnection: Upgrade\r\nSec-WebSocket-Key: oxbqj2GLbT9S9bZYVM+9eg==\r\nSec-WebSocket-Version:",
"target_port_label": "1963 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly",
"http_no_ua"
]
}
|
|
|
TCP |
1963 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1963 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1963
Chemin / cible
—
Service
TLS
Payload
� �� as.L�`f���������=�īߎ�(��J�� [��4�}���� �#�����P��ΊnXt~�f &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� as.L�`f���������=�īߎ�(��J�� [��4�}���� �#�����P��ΊnXt~�f &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �� as.L�`f���������=�īߎ�(��J�� [��4�}���� �#�����P��ΊnXt~�f &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ &py�WV�_�r��c�J����CpSo�ִ>Z
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.910200281695912,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aec791e069ea8597c13e436b512e5a626e94c7a4",
"event_fingerprint": "7f6ca270d6562f05b62f0df1744b5d3d6371467e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "c8ea09fe32f0de2f8946022786dfad9a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1963,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd\ufffd\u0001\ufffd\ufffd\b\ufffdP\ufffd\ufffd\u038anXt~\ufffdf\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd\ufffd\u0001\ufffd\ufffd\b\ufffdP\ufffd\ufffd\u038anXt~\ufffdf\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0014&p\u001b\u0006y\ufffdWV\ufffd_\ufffdr\u0017\ufffd\ufffdc\ufffdJ\ufffd\ufffd\ufffd\ufffdCpSo\ufffd\u05b4>Z",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd\ufffd\u0001\ufffd\ufffd\b\ufffdP\ufffd\ufffd\u038anXt~\ufffdf\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "862e87ed670c8badf2c22d608c34d1255a1da246",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd\ufffd\u0001\ufffd\ufffd\b\ufffdP\ufffd\ufffd\u038anXt~\ufffdf\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\u038anXt~\ufffdf&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd\ufffd\u0001\ufffd\ufffd\b\ufffdP\ufffd\ufffd\u038anXt~\ufffdf\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1963,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd as.L\ufffd`f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\u012b\u07ce\ufffd(\ufffd\ufffdJ\ufffd\ufffd [\ufffd\ufffd4\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\u038anXt~\ufffdf&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1963 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:1963",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
1963
|
—
|
Sonde port
Sonde port · port 1963 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1963
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6becfeb9c20c00c6b8249aacb3872c02192a0b49",
"event_fingerprint": "a4be6cc4a8423fa085cec9b46ea256c26b87c902",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 1963,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fe3ff60f2f85aa086afca549968070f0d764286",
"protocol_details": {
"port": 1963
},
"attack_vector": "Sonde port \u00b7 port 1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 1963
},
"attack_vector": "Sonde port \u00b7 port 1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1963",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
1963
|
—
|
Sonde port
Sonde port · port 1963 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1963
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0577
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
x� IBETH01N0_M
Meta JSON brut
{
"bytes_in": 26,
"payload_entropy": 3.6235166412180138,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 1963,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6becfeb9c20c00c6b8249aacb3872c02192a0b49",
"event_fingerprint": "a4be6cc4a8423fa085cec9b46ea256c26b87c902",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0577"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b7348cda1310dd8e9699ce5ceda794a9",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 1963,
"risk_score": 44
},
"payload_preview": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"request_sample": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"payload_snippet": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"evidence": {
"request_sample": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"payload_snippet": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73527e32a119c2d949d7f725b1086d9be5001686",
"protocol_details": {
"payload_preview": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"port": 1963
},
"evidence_snippet": "x\ufffdIBETH01N0_M",
"attack_vector": "Sonde port \u00b7 port 1963 \u00b7 (sonde \/ probe)",
"target_port_label": "1963",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1963,
"protocol_emulated": null,
"tags_summary": [
"pat-0577"
],
"tags_summary_labels_fr": [
"pat-0577"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x\ufffd\u0000\u0003\u0000\fIBETH01N0_M\u0000",
"port": 1963
},
"attack_vector": "Sonde port \u00b7 port 1963 \u00b7 (sonde \/ probe)",
"evidence_snippet": "x\ufffdIBETH01N0_M",
"target_port_label": "1963",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1963"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
4073 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4073 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4073
Chemin / cible
—
Service
TLS
Payload
� � �Sc��*8O*C�R�TyKriĐ�|ב��>�- �e�6� [P��U7�1O�Q���TK�U ��Ξ} &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �Sc��*8O*C�R�TyKriĐ�|ב��>�- �e�6� [P��U7�1O�Q���TK�U ��Ξ}
&̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� � �Sc��*8O*C�R�TyKriĐ�|ב��>�- �e�6� [P��U7�1O�Q���TK�U ��Ξ} &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��Z�/�4#��I�O`dv�*{���ǫ�;���p
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.868314559128426,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "356baaba4f642eee0bd43e68a5f8dfafdab2620f",
"event_fingerprint": "74667ff17ffaa2df3c96a9b0e80b659b6632a683",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "478f2956be3175a0263b9003711f8ba2",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4073,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001c\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdT\u000eyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\u0017\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd\u00021O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\u001c\ufffd\ufffd\u039e}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001c\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdT\u000eyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\u0017\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd\u00021O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\u001c\ufffd\ufffd\u039e}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdZ\ufffd\/\ufffd4#\ufffd\ufffd\u0001I\ufffdO`dv\ufffd*{\ufffd\ufffd\ufffd\u01eb\ufffd;\u0001\ufffd\ufffd\ufffdp",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001c\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdT\u000eyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\u0017\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd\u00021O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\u001c\ufffd\ufffd\u039e}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a750b54b93d528ff9a481647da68afc1e551264",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001c\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdT\u000eyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\u0017\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd\u00021O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\u001c\ufffd\ufffd\u039e}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdTyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd1O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\ufffd\ufffd\u039e}\n&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001c\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdT\u000eyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\u0017\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd\u00021O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\u001c\ufffd\ufffd\u039e}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdSc\ufffd\ufffd*8O*C\ufffdR\ufffdTyKri\u0110\ufffd|\u05d1\ufffd\ufffd>\ufffd- \ufffde\ufffd6\ufffd [P\ufffd\ufffdU7\ufffd1O\ufffdQ\ufffd\ufffd\ufffdTK\ufffdU\ufffd\ufffd\u039e}\n&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4073 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:4073 · (tentative d'exploit) · → /login
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /login UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4073
Chemin / cible
/login
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — 4 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /login HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:4073
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Requête brute (extrait)
GET /login HTTP/1.1 Host: 62.3.50.33:4073 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "c20d7c3d437df36599a04fd3f39966c462254418",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 166,
"payload_entropy": 5.188713865292366,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 67.5,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 67.5,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "9e925eb0fcbfa8ddfde4a8666c469ce1df099c75",
"event_fingerprint": "474e4294e1999c70f685b7f4378b045fdde62ca1",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "229e522556c0638cd912ef083cba458a",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 4073,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "695aea696155df29bd141e1fc098165a4741b2b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"attack_vector": "lfi path traversal \u00b7 via HTTP:4073 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 59%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 67.5,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:4073 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_probe_login",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
4073 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4073 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4073
Chemin / cible
—
Service
TLS
Payload
� ���,U�^�V<�>�"ZP���L��Ce���~b� `�8cKh�4d��H# TX&��@��Y-{�8�˙ &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���,U�^�V<�>�"ZP���L��Ce���~b� `�8cKh�4d��H#
TX&��@��Y-{�8�˙ &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���,U�^�V<�>�"ZP���L��Ce���~b� `�8cKh�4d��H# TX&��@��Y-{�8�˙ &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���M8��CV~ �'k��W��ƅ��z|��}nn
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.882919662423932,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "356baaba4f642eee0bd43e68a5f8dfafdab2620f",
"event_fingerprint": "74667ff17ffaa2df3c96a9b0e80b659b6632a683",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "dd8ccf125bb2606ca0ae2bedf40376ad",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4073,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd,U\ufffd\u000f^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\u0017\u0001\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffd\bH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd,U\ufffd\u000f^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\u0017\u0001\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffd\bH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdM8\ufffd\ufffdCV~\u001d\ufffd\u0019'k\ufffd\ufffdW\ufffd\ufffd\u0185\ufffd\ufffdz|\ufffd\ufffd}nn",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd,U\ufffd\u000f^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\u0017\u0001\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffd\bH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70f58a50dcf53aa173f84298c986a60ac8b8825a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd,U\ufffd\u000f^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\u0017\u0001\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffd\bH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd,U\ufffd^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffdH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd,U\ufffd\u000f^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\u0017\u0001\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffd\bH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd,U\ufffd^\ufffdV<\ufffd>\ufffd\"ZP\ufffd\ufffd\ufffdL\ufffd\ufffdCe\ufffd\ufffd\ufffd~b\ufffd `\ufffd8cKh\ufffd4d\ufffd\ufffdH#\nTX&\ufffd\ufffd@\ufffd\ufffdY-{\ufffd8\ufffd\u02d9&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4073 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:4073 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4073
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4073
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4073 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "c20d7c3d437df36599a04fd3f39966c462254418",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 161,
"payload_entropy": 5.192679203957217,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "032aa76d1d0cf3caadd3f0d4c27cd6a55ce9d879",
"event_fingerprint": "8d63b131914312353caeb93ca858a8864bec04f4",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "1a0d9d99269e6ce5bf5974a39c206748",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4073,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f837436182ac736ba4b163a4c3ddd89ce18de16d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"attack_vector": "web scanner \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
4073 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:4073 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
4073
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "af1883f93c50e3dea979394ffd8f6cd779e256eb",
"event_fingerprint": "06fb1d8ccf07484df2fbc7b62e66ee24dbba5b69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 4073,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb683cdfc1ca9b7bb6bb930b7581713d2a1dcd9d",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
4073 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4073 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4073
Chemin / cible
—
Service
TLS
Payload
� � �D.J t|�ؔǷ�� _��T�n����zc z���9 � t ����J5?N߯��Q����n6* &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �D.J t|�ؔǷ�� _��T�n����zc z���9 � t ����J5?N߯��Q����n6* &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� � �D.J t|�ؔǷ�� _��T�n����zc z���9 � t ����J5?N߯��Q����n6* &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � u�?�[k�= a=�f����n�$ۏc
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.785760648125841,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "356baaba4f642eee0bd43e68a5f8dfafdab2620f",
"event_fingerprint": "74667ff17ffaa2df3c96a9b0e80b659b6632a683",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "8b7ced3fd1aa5bb850033db05c4f3bf5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4073,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b\ufffdD.J\u001ft|\ufffd\u0614\u01f7\ufffd\ufffd _\u0019\ufffd\ufffdT\ufffdn\ufffd\u0017\ufffd\u0007\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\u000b\ufffd\ft\u001d\ufffd\ufffd\ufffd\ufffdJ5?N\u0011\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b\ufffdD.J\u001ft|\ufffd\u0614\u01f7\ufffd\ufffd _\u0019\ufffd\ufffdT\ufffdn\ufffd\u0017\ufffd\u0007\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\u000b\ufffd\ft\u001d\ufffd\ufffd\ufffd\ufffdJ5?N\u0011\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001a\u001fu\b\ufffd?\ufffd[k\ufffd=\u0004\n\u0001a\u001b=\ufffdf\ufffd\ufffd\u0016\ufffd\ufffdn\ufffd$\u06cfc",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b\ufffdD.J\u001ft|\ufffd\u0614\u01f7\ufffd\ufffd _\u0019\ufffd\ufffdT\ufffdn\ufffd\u0017\ufffd\u0007\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\u000b\ufffd\ft\u001d\ufffd\ufffd\ufffd\ufffdJ5?N\u0011\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e65960fc6d7d602a99345af71ba4f3ae4b06c0a4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b\ufffdD.J\u001ft|\ufffd\u0614\u01f7\ufffd\ufffd _\u0019\ufffd\ufffdT\ufffdn\ufffd\u0017\ufffd\u0007\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\u000b\ufffd\ft\u001d\ufffd\ufffd\ufffd\ufffdJ5?N\u0011\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdD.Jt|\ufffd\u0614\u01f7\ufffd\ufffd _\ufffd\ufffdT\ufffdn\ufffd\ufffd\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\ufffdt\ufffd\ufffd\ufffd\ufffdJ5?N\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b\ufffdD.J\u001ft|\ufffd\u0614\u01f7\ufffd\ufffd _\u0019\ufffd\ufffdT\ufffdn\ufffd\u0017\ufffd\u0007\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\u000b\ufffd\ft\u001d\ufffd\ufffd\ufffd\ufffdJ5?N\u0011\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 4073,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdD.Jt|\ufffd\u0614\u01f7\ufffd\ufffd _\ufffd\ufffdT\ufffdn\ufffd\ufffd\ufffd\ufffdzc z\ufffd\ufffd\ufffd9\ufffdt\ufffd\ufffd\ufffd\ufffdJ5?N\u07ef\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdn6*&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "4073 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
4073 · HTTP
|
http
|
http
http · via HTTP:4073 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4073
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61%
Confiance classification
69%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4073
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c20d7c3d437df36599a04fd3f39966c462254418",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 41,
"payload_entropy": 4.259514199528965,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1b2bb0adfa1c9f5d52de2633e764be0f8533839e",
"event_fingerprint": "1b4e20152d1d32ed5d3eaf0f7df1de8552a18790",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b88cfac8071738c28b064bbc717b762",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 4073,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.69,
"classification_confidence": 0.69,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b23e39f17f4363bfb28fdfd16f2fffdba0065e46",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073",
"attack_vector": "http \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 4073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4073",
"target_port_label": "4073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:4073",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua"
]
}
|
|
|
TCP |
4073
|
—
|
Sonde port
Sonde port · port 4073 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4073
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 4073,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6ef2ff9928a1a3ffe3befcf7566b450597375736",
"event_fingerprint": "ba6c41b9d7fcee7101906fd7ca807926df360824",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 4073,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a7609cae4baab28bd7ddb0b5324f56783317a840",
"protocol_details": {
"port": 4073
},
"attack_vector": "Sonde port \u00b7 port 4073 \u00b7 (sonde \/ probe)",
"target_port_label": "4073",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4073,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 4073
},
"attack_vector": "Sonde port \u00b7 port 4073 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4073",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
12155 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:12155 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12155
Chemin / cible
—
Service
TLS
Payload
� ��Wj��M��P})�G3 }K?[Ԍ����~����E �eu?i�t��~h�����#cmQ>�DH�R�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Wj��M��P})�G3 }K?[Ԍ����~����E �eu?i�t��~h�����#cmQ>�DH�R�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��Wj��M��P})�G3 }K?[Ԍ����~����E �eu?i�t��~h�����#cmQ>�DH�R�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��1� D�0�=�3��pjf�Y ^�A,l�?5
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.860525600579992,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a67e37f9138bba19c786bc7660e206eb01bed632",
"event_fingerprint": "c6bb97f369550b9329e8bb6333c33cf46a854c2d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "58cfbac1319a6699aa68f42298867b92",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 12155,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3\u001d}K?[\u0019\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\u0005\u0012\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u0018#cmQ>\ufffdDH\ufffdR\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3\u001d}K?[\u0019\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\u0005\u0012\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u0018#cmQ>\ufffdDH\ufffdR\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd1\ufffd\u001fD\ufffd\u00100\ufffd=\ufffd3\ufffd\ufffdpjf\ufffdY\u001d^\ufffdA,l\u0011\ufffd?\u000f5\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3\u001d}K?[\u0019\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\u0005\u0012\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u0018#cmQ>\ufffdDH\ufffdR\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f92d2e8d3453e476b648ff374065833477ecd28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3\u001d}K?[\u0019\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\u0005\u0012\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u0018#cmQ>\ufffdDH\ufffdR\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3}K?[\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\ufffd\ufffd#cmQ>\ufffdDH\ufffdR\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3\u001d}K?[\u0019\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\u0005\u0012\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\u0015\ufffd\ufffd\u0018#cmQ>\ufffdDH\ufffdR\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdWj\ufffd\ufffdM\ufffd\ufffdP})\ufffdG3}K?[\u050c\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdE \ufffdeu?i\ufffdt\ufffd\ufffd~h\ufffd\ufffd\ufffd\ufffd\ufffd#cmQ>\ufffdDH\ufffdR\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
12155 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:12155 · (sonde / probe) · → /sitemap.xml
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sitemap.xml UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12155
Chemin / cible
/sitemap.xml
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:12155
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys
Requête brute (extrait)
GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:12155 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "e2f58dbf6774992b3917e262942f67242b24ed77",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 173,
"payload_entropy": 5.172599742108947,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 67.5,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4385f33bd5cbd972cc3a40ad5054b2b3e6d5d035",
"event_fingerprint": "c77f00f13cb3e0f4ec40dc9a732f9e8b11d13082",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "e66ff1778a152316527b99c2fff88c19",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 12155,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efe9a751c09b26d0d7061915aa75f8ce6aec36ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys",
"attack_vector": "web scanner \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
12155 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:12155 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12155
Chemin / cible
—
Service
TLS
Payload
� ����t i��|Hc�� ���!�gL�B���aSX� =S2כ/$Z���ȏ��X�l���$UJ&�Ʋ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����t i��|Hc�� ���!�gL�B���aSX� =S2כ/$Z���ȏ��X�l���$UJ&�Ʋ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ����t i��|Hc�� ���!�gL�B���aSX� =S2כ/$Z���ȏ��X�l���$UJ&�Ʋ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � �>�)L/N t�d�p��[ܙG����5E�L�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.853901565705767,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a67e37f9138bba19c786bc7660e206eb01bed632",
"event_fingerprint": "c6bb97f369550b9329e8bb6333c33cf46a854c2d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "3dfae3d8e9232811bedebed4dc92c317",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 12155,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0017t\u001ei\ufffd\ufffd\u0018|Hc\ufffd\ufffd\u001e\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd\u0019$UJ&\ufffd\u01b2\ufffd\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0017t\u001ei\ufffd\ufffd\u0018|Hc\ufffd\ufffd\u001e\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd\u0019$UJ&\ufffd\u01b2\ufffd\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd \ufffd>\ufffd)L\/N\u0007 t\ufffdd\ufffdp\ufffd\ufffd[\u0719G\ufffd\ufffd\ufffd\ufffd5E\ufffdL\ufffd\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0017t\u001ei\ufffd\ufffd\u0018|Hc\ufffd\ufffd\u001e\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd\u0019$UJ&\ufffd\u01b2\ufffd\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fd259c64574198e3fc7f404495a9d9e304ff472",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0017t\u001ei\ufffd\ufffd\u0018|Hc\ufffd\ufffd\u001e\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd\u0019$UJ&\ufffd\u01b2\ufffd\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdti\ufffd\ufffd|Hc\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd$UJ&\ufffd\u01b2\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0017t\u001ei\ufffd\ufffd\u0018|Hc\ufffd\ufffd\u001e\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd\u0019$UJ&\ufffd\u01b2\ufffd\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdti\ufffd\ufffd|Hc\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffdgL\ufffdB\ufffd\ufffd\ufffdaSX\ufffd =S2\u05db\/$Z\ufffd\ufffd\ufffd\u020f\ufffd\ufffdX\ufffdl\ufffd\ufffd\ufffd$UJ&\ufffd\u01b2\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
12155 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:12155 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12155
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:12155
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Acce
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:12155 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "e2f58dbf6774992b3917e262942f67242b24ed77",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 162,
"payload_entropy": 5.156109011874327,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "0960155fb016fbde004398e835d386967058ad08",
"event_fingerprint": "b2b1f51c67839cfb355f02c55320c6c89670d407",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "faae5d7de6a7757bd062a26b915f737d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12155,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e12bef38f26cc4b6690f2fbc474c0f558209e5ca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"attack_vector": "web scanner \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAcce",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
12155 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:12155 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
12155
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3dbcf0613f1e3fe0a25c599a205b2ce88618a3d4",
"event_fingerprint": "4c4ca0080edf70cd99a5b2349d6b24320112550f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 12155,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a244ff361d63ee6c128cbfa7d74817313f8a1720",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
]
}
|
|
|
TCP |
12155 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:12155 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
8
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
951040:websocket-anomaly
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12155
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 40 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
websocket-anomaly
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:12155
Connection: Upgrade
Sec-WebSocket-Key: ZErrHpyAbfBXXdCnBx/sUw==
Sec-WebSocket-Version:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:12155 Connection: Upgrade Sec-WebSocket-Key: ZErrHpyAbfBXXdCnBx/sUw== Sec-WebSocket-Version: 13 Upgrade: websocket
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "e2f58dbf6774992b3917e262942f67242b24ed77",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 155,
"payload_entropy": 5.248970430582908,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 40,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40e821d8a68fec25b088a0cbb9e63dcca7acbbbc",
"event_fingerprint": "92480c7cbabc54ab14f3771f9585d30b5e00794f",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9d063fc610b81a66f698ea0f1f6cef59",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 12155,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version:",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version:",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version:",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2519ef7c01a242dd2772062be0e5d51f087587e0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version:",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 12155,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12155\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ZErrHpyAbfBXXdCnBx\/sUw==\r\nSec-WebSocket-Version:",
"target_port_label": "12155 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly",
"http_no_ua"
]
}
|
|
|
TCP |
12155 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:12155 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12155
Chemin / cible
—
Service
TLS
Payload
� � ?;;��� F��W��-���t�{�p#���i �R����A�0�U��i���nRx�F�7 %8�@V &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � ?;;��� F��W��-���t�{�p#���i �R����A�0�U��i���nRx�F�7 %8�@V &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� � ?;;��� F��W��-���t�{�p#���i �R����A�0�U��i���nRx�F�7 %8�@V &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ Y����"{z�TK����% �C�h7QՍ#�N
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.806589429972014,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a67e37f9138bba19c786bc7660e206eb01bed632",
"event_fingerprint": "c6bb97f369550b9329e8bb6333c33cf46a854c2d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "dbe51c02664569d8becdf8eedbbce418",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 12155,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b?;;\ufffd\ufffd\ufffd\u000bF\ufffd\ufffdW\u0001\ufffd\ufffd-\ufffd\u0015\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\u0018\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd\u00160\u0016\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7\u001d%8\ufffd@V\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b?;;\ufffd\ufffd\ufffd\u000bF\ufffd\ufffdW\u0001\ufffd\ufffd-\ufffd\u0015\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\u0018\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd\u00160\u0016\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7\u001d%8\ufffd@V\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 Y\ufffd\u0019\ufffd\ufffd\ufffd\"{z\ufffdTK\ufffd\ufffd\u0012\ufffd\ufffd%\u0014\r\u0013\ufffdC\ufffdh7Q\u054d#\ufffdN",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b?;;\ufffd\ufffd\ufffd\u000bF\ufffd\ufffdW\u0001\ufffd\ufffd-\ufffd\u0015\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\u0018\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd\u00160\u0016\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7\u001d%8\ufffd@V\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c69d4ceb4548f6e5d4b339b4c179d54ca7505346",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b?;;\ufffd\ufffd\ufffd\u000bF\ufffd\ufffdW\u0001\ufffd\ufffd-\ufffd\u0015\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\u0018\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd\u00160\u0016\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7\u001d%8\ufffd@V\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd?;;\ufffd\ufffd\ufffdF\ufffd\ufffdW\ufffd\ufffd-\ufffd\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd0\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7%8\ufffd@V&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000b?;;\ufffd\ufffd\ufffd\u000bF\ufffd\ufffdW\u0001\ufffd\ufffd-\ufffd\u0015\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\u0018\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd\u00160\u0016\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7\u001d%8\ufffd@V\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 12155,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd?;;\ufffd\ufffd\ufffdF\ufffd\ufffdW\ufffd\ufffd-\ufffd\ufffd\ufffdt\ufffd{\ufffdp#\ufffd\ufffd\ufffdi \ufffdR\ufffd\ufffd\ufffd\ufffdA\ufffd0\ufffdU\ufffd\ufffdi\ufffd\ufffd\ufffdnRx\ufffdF\ufffd7%8\ufffd@V&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "12155 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:12155",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
12155
|
—
|
Sonde port
Sonde port · port 12155 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12155
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 12155,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2998a1a32a48fcf6b49a78609fe2b77be1a4252e",
"event_fingerprint": "44a0f4578736776241084e41efd3fadd3c9f697f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 12155,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38098fa1445ee9a483d40ab6104fe09897e611ca",
"protocol_details": {
"port": 12155
},
"attack_vector": "Sonde port \u00b7 port 12155 \u00b7 (sonde \/ probe)",
"target_port_label": "12155",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 12155,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 12155
},
"attack_vector": "Sonde port \u00b7 port 12155 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "12155",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "12155"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6984 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:6984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Service
TLS
Payload
� ��b3'�Snş|�������Ʒ#hM�ѳ��� �{J�T ���O��T�(��8g�C�_v�« &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��b3'�Snş|�������Ʒ#hM�ѳ��� �{J�T ���O��T�(��8g�C�_v�« &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��b3'�Snş|�������Ʒ#hM�ѳ��� �{J�T ���O��T�(��8g�C�_v�« &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ `�M�G3�\\ ������c�vU#�����7
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.840428189340426,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c06263b270f3929a2b3f866d59dec56d7dac7671",
"event_fingerprint": "25e5aadd5993d2f84dcc12109fdcc8d058341746",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "bef58d4058673a0802b16bd28555c065",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 6984,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u01b7#hM\ufffd\u001a\u0473\ufffd\ufffd\ufffd \ufffd{\u0015J\ufffdT\f\ufffd\ufffd\ufffd\u001bO\ufffd\ufffdT\ufffd\u0010(\ufffd\ufffd8g\ufffdC\ufffd\u0014_\u0001v\ufffd\u00ab\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u01b7#hM\ufffd\u001a\u0473\ufffd\ufffd\ufffd \ufffd{\u0015J\ufffdT\f\ufffd\ufffd\ufffd\u001bO\ufffd\ufffdT\ufffd\u0010(\ufffd\ufffd8g\ufffdC\ufffd\u0014_\u0001v\ufffd\u00ab\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 `\ufffdM\u000f\ufffdG3\ufffd\\\\\b\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffdvU#\ufffd\ufffd\u0005\ufffd\u0017\ufffd\ufffd7\u000e",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u01b7#hM\ufffd\u001a\u0473\ufffd\ufffd\ufffd \ufffd{\u0015J\ufffdT\f\ufffd\ufffd\ufffd\u001bO\ufffd\ufffdT\ufffd\u0010(\ufffd\ufffd8g\ufffdC\ufffd\u0014_\u0001v\ufffd\u00ab\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9eed00b248c16a6c20a1adcc3fb32bf5924c0eee",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u01b7#hM\ufffd\u001a\u0473\ufffd\ufffd\ufffd \ufffd{\u0015J\ufffdT\f\ufffd\ufffd\ufffd\u001bO\ufffd\ufffdT\ufffd\u0010(\ufffd\ufffd8g\ufffdC\ufffd\u0014_\u0001v\ufffd\u00ab\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01b7#hM\ufffd\u0473\ufffd\ufffd\ufffd \ufffd{J\ufffdT\ufffd\ufffd\ufffdO\ufffd\ufffdT\ufffd(\ufffd\ufffd8g\ufffdC\ufffd_v\ufffd\u00ab&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u01b7#hM\ufffd\u001a\u0473\ufffd\ufffd\ufffd \ufffd{\u0015J\ufffdT\f\ufffd\ufffd\ufffd\u001bO\ufffd\ufffdT\ufffd\u0010(\ufffd\ufffd8g\ufffdC\ufffd\u0014_\u0001v\ufffd\u00ab\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdb3'\ufffdSn\u015f|\u0089\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01b7#hM\ufffd\u0473\ufffd\ufffd\ufffd \ufffd{J\ufffdT\ufffd\ufffd\ufffdO\ufffd\ufffdT\ufffd(\ufffd\ufffd8g\ufffdC\ufffd_v\ufffd\u00ab&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6984 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:6984 · (sonde / probe) · → /sitemap.xml
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /sitemap.xml UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
27
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6984
Chemin / cible
/sitemap.xml
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:6984
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.
Requête brute (extrait)
GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:6984 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "da7cae23263de792e4fb521b87591bb7601a5baa",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 172,
"payload_entropy": 5.229630144283611,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 67.5,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5ac371bd1e18633351d63ed0ccd40d16a815fa32",
"event_fingerprint": "5b03c458ce523c69ac32ab4529fffc83aa182319",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "3f7762e79855b4d40fcb8b0c68da45cd",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 6984,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2433e421d54141a68f133367c448a2cfee9f55b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"attack_vector": "web scanner \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 67.5,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 67 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
6984 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:6984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Service
TLS
Payload
� �ք �t�9�Y���.??�Y�x(+D������ :m��5d*|}�3=���L��a���3�+�^U�o &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ք �t�9�Y���.??�Y�x(+D������ :m��5d*|}�3=���L��a���3�+�^U�o &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �ք �t�9�Y���.??�Y�x(+D������ :m��5d*|}�3=���L��a���3�+�^U�o &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ����wm��ɭe�~m�%i�!;�k���x9~
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8153845872874586,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c06263b270f3929a2b3f866d59dec56d7dac7671",
"event_fingerprint": "25e5aadd5993d2f84dcc12109fdcc8d058341746",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "e6519b009176cc0d1eb984303eaf68ec",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 6984,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0584\f\ufffdt\ufffd9\u0006\ufffdY\ufffd\ufffd\ufffd\b\u000e.??\ufffdY\ufffdx(+D\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffd\u0006a\ufffd\ufffd\ufffd\u00073\ufffd+\ufffd^U\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0584\f\ufffdt\ufffd9\u0006\ufffdY\ufffd\ufffd\ufffd\b\u000e.??\ufffdY\ufffdx(+D\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffd\u0006a\ufffd\ufffd\ufffd\u00073\ufffd+\ufffd^U\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\u0010wm\ufffd\ufffd\u026de\ufffd~m\ufffd%i\ufffd!;\b\ufffdk\ufffd\ufffd\ufffd\u0019x9\u0012~",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0584\f\ufffdt\ufffd9\u0006\ufffdY\ufffd\ufffd\ufffd\b\u000e.??\ufffdY\ufffdx(+D\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffd\u0006a\ufffd\ufffd\ufffd\u00073\ufffd+\ufffd^U\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31ecdaa6f5d1cabb3d91475c8d842cdebc4604f5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0584\f\ufffdt\ufffd9\u0006\ufffdY\ufffd\ufffd\ufffd\b\u000e.??\ufffdY\ufffdx(+D\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffd\u0006a\ufffd\ufffd\ufffd\u00073\ufffd+\ufffd^U\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0584\ufffdt\ufffd9\ufffdY\ufffd\ufffd\ufffd.??\ufffdY\ufffdx(+D\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffda\ufffd\ufffd\ufffd3\ufffd+\ufffd^U\ufffdo&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0584\f\ufffdt\ufffd9\u0006\ufffdY\ufffd\ufffd\ufffd\b\u000e.??\ufffdY\ufffdx(+D\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffd\u0006a\ufffd\ufffd\ufffd\u00073\ufffd+\ufffd^U\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0584\ufffdt\ufffd9\ufffdY\ufffd\ufffd\ufffd.??\ufffdY\ufffdx(+D\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd :m\ufffd\ufffd5d*|}\ufffd3=\ufffd\ufffd\ufffdL\ufffd\ufffda\ufffd\ufffd\ufffd3\ufffd+\ufffd^U\ufffdo&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6984 · HTTP
|
http
|
Scanner web
web scanner · via HTTP:6984 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.cens…
Émulateur
HTTP
WAF
30
Recommandation
Surveiller
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6984
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Scanner Censys
Upstream
Waf Score
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
UA censys
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6984
User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6984 User-Agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5f5db91a9e2e02c1396d851db979a6f7b4d4b364",
"http_host_hash": "da7cae23263de792e4fb521b87591bb7601a5baa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 161,
"payload_entropy": 5.217523924454112,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 75,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fc66f33da66332a7623b6d5f80515d21c0fc6636",
"event_fingerprint": "da9749c566b4da18ec1f0189558b7912c67866f9",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 145,
"precision_signals": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0431"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA censys"
],
"pattern_ids": [
"pat-0103",
"pat-0431"
],
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32e8fb3a921e31a4753da44965548f23",
"payload_hash": "8a5ee6d511266651cb64a4a5d79d45c7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6984,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d30858ad997498bc39ff7ca2782d23747049c21",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"attack_vector": "web scanner \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 75,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"INT-scanner-censys",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Scanner Censys",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "web scanner \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nUser-Agent: Mozilla\/5.0 (compatible; CensysInspect\/1.1; +https:\/\/about.censys.io\/)\r\nAccep",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 75 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner"
]
}
|
|
|
TCP |
6984 · HTTP
|
http
|
Sonde PostgreSQL
postgres probe · via HTTP:6984 · (sonde / probe) · → *
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PRI *
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
Cible HTTP
PRI
*
TLS SNI
—
Capteur
paris-1
|
Méthode
PRI
Port
6984
Chemin / cible
*
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
Ligne de requête
PRI * HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
PRI * HTTP/2.0
SM
Bh
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "df58248c414f342c81e056b40bee12d17a08bf61",
"http_referer_hash": null,
"http_method": "PRI",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 57,
"payload_entropy": 3.474882067394362,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c79acadfc6bf10b1ceba4739102cbbaeb46afbc1",
"event_fingerprint": "d1b8a3d7749980541d3425e4a69af72c259e87dd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe3435fc30fb19e768a81e744ede3fba",
"path_pattern_hash": "684888c0ebb17f374298b65ee2807526"
},
"target_context": {
"dst_port": 6984,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"method": "PRI",
"path": "*",
"request_line": "PRI * HTTP\/1.1",
"request_sample": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n",
"payload_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9896dd2a0a6508bed2dd41cd55312db54897094e",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"attack_vector": "postgres probe \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "PRI",
"http_path": "*",
"request_line": "PRI * HTTP\/1.1",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "postgres probe \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe) \u00b7 \u2192 *",
"evidence_snippet": "PRI * HTTP\/2.0\r\n\r\nSM\r\n\r\nBh",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua"
]
}
|
|
|
TCP |
6984 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:6984 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
8
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
951040:websocket-anomaly
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6984
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 40 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
websocket-anomaly
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6984
Connection: Upgrade
Sec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==
Sec-WebSocket-Version:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6984 Connection: Upgrade Sec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg== Sec-WebSocket-Version: 13 Upgrade: websocket
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "da7cae23263de792e4fb521b87591bb7601a5baa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 154,
"payload_entropy": 5.238368312927402,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "http",
"app_proto": "http",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 40,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ecc8e8d68f7fa9f715be6f4e4560cc0668f62f98",
"event_fingerprint": "069dab3c057cd62f6a900aca66c4ffe7935def32",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b1c00da0a19b84fb148f35bcb118ad6d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 6984,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version: ",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version:",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"websocket-anomaly"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version: 13\r\nUpgrade: websocket\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version:",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2038cd1dbe1879e171c295ee7deb96a8a2f26b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version:",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 40,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 6984,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6984\r\nConnection: Upgrade\r\nSec-WebSocket-Key: Scrxy9sygdEKQbdgqQS7pg==\r\nSec-WebSocket-Version:",
"target_port_label": "6984 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 40 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 40 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"951040:websocket-anomaly",
"http_no_ua"
]
}
|
|
|
TCP |
6984 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:6984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Service
TLS
Payload
� �y<[K�D��� 0Yˆ H:{�#{�%��b� �̥�+@���7�ѥ&�� �h�c��q �Lj &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �y<[K�D��� 0Yˆ H:{�#{�%��b� �̥�+@���7�ѥ&�� �h�c��q
�Lj &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �y<[K�D��� 0Yˆ H:{�#{�%��b� �̥�+@���7�ѥ&�� �h�c��q �Lj &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ʼn"�/ y�� X���It��������x�X
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.747381135474464,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c06263b270f3929a2b3f866d59dec56d7dac7671",
"event_fingerprint": "25e5aadd5993d2f84dcc12109fdcc8d058341746",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "0395f091e217c63eabfb95df805f4608",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 6984,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y<[K\ufffd\u0007D\ufffd\ufffd\ufffd\u0002\t0Y\u0001\u02c6 H:{\ufffd#{\ufffd%\b\ufffd\ufffdb\ufffd\u0005 \ufffd\u0325\u0005\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\u0015\f\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y<[K\ufffd\u0007D\ufffd\ufffd\ufffd\u0002\t0Y\u0001\u02c6 H:{\ufffd#{\ufffd%\b\ufffd\ufffdb\ufffd\u0005 \ufffd\u0325\u0005\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\u0015\f\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0149\"\ufffd\/\b\fy\ufffd\ufffd\u001eX\ufffd\ufffd\ufffd\u0019It\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0001\ufffd\ufffdx\ufffdX",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y<[K\ufffd\u0007D\ufffd\ufffd\ufffd\u0002\t0Y\u0001\u02c6 H:{\ufffd#{\ufffd%\b\ufffd\ufffdb\ufffd\u0005 \ufffd\u0325\u0005\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\u0015\f\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cdb0c141693902ac43ecf3b27e339014b3678929",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y<[K\ufffd\u0007D\ufffd\ufffd\ufffd\u0002\t0Y\u0001\u02c6 H:{\ufffd#{\ufffd%\b\ufffd\ufffdb\ufffd\u0005 \ufffd\u0325\u0005\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\u0015\f\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdy<[K\ufffdD\ufffd\ufffd\ufffd\t0Y\u02c6 H:{\ufffd#{\ufffd%\ufffd\ufffdb\ufffd \ufffd\u0325\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y<[K\ufffd\u0007D\ufffd\ufffd\ufffd\u0002\t0Y\u0001\u02c6 H:{\ufffd#{\ufffd%\b\ufffd\ufffdb\ufffd\u0005 \ufffd\u0325\u0005\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\u0015\f\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdy<[K\ufffdD\ufffd\ufffd\ufffd\t0Y\u02c6 H:{\ufffd#{\ufffd%\ufffd\ufffdb\ufffd \ufffd\u0325\ufffd+@\ufffd\ufffd\ufffd7\ufffd\u0465&\ufffd\ufffd\ufffdh\ufffdc\ufffd\ufffdq\r\ufffdLj&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:6984",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
6984
|
—
|
Sonde port
Sonde port · port 6984 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Censys, Inc.",
"service": null,
"app_proto": null,
"asn": 398705,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6adf71ff71e0e22fd5b7b3e679b8f805156e75b2",
"event_fingerprint": "4672b18520d338a0e60b8b8b3da651339c992662",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 6984,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a89698683b9d0e678d75b9a59dd86dd057a1c593",
"protocol_details": {
"port": 6984
},
"attack_vector": "Sonde port \u00b7 port 6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 6984
},
"attack_vector": "Sonde port \u00b7 port 6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "6984",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
19371 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:19371 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19371
Chemin / cible
—
Service
TLS
Payload
� �N���#�.�];�}��<��"���n���ſ -1���V�Ho��ȻZX�h��yY��$�Ҭ &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N���#�.�];�}��<��"���n���ſ -1���V�Ho��ȻZX�h��yY��$�Ҭ &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �N���#�.�];�}��<��"���n���ſ -1���V�Ho��ȻZX�h��yY��$�Ҭ &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ r�< ]� ��ܴQ�>Ms @#�T`=�<����
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8513960230743045,
"port_category": "registered",
"org": "Censys, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 398705,
"country": "US",
"dst_port": 19371,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c98fe988d8f3e0af4d3c60f1a4e81a96fdf55c7d",
"event_fingerprint": "a87da048675eac363cbf3c4f17ebcd5120e799ad",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 398705,
"org": "Censys, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "25774fa4663bc193024486faf7d1fcb8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19371,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd#\ufffd\u0012.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\u0017\u0007\"\u0012\ufffd\ufffd\ufffdn\ufffd\ufffd\u001b\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\u0005\ufffd\ufffd\u0014yY\ufffd\u0005\u0016\ufffd$\ufffd\u04ac\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd#\ufffd\u0012.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\u0017\u0007\"\u0012\ufffd\ufffd\ufffdn\ufffd\ufffd\u001b\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\u0005\ufffd\ufffd\u0014yY\ufffd\u0005\u0016\ufffd$\ufffd\u04ac\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 r\ufffd<\r]\ufffd\u001f\ufffd\u000e\ufffd\u0734Q\ufffd>Ms\t@#\ufffdT`=\u000f\ufffd<\ufffd\ufffd\ufffd\ufffd\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd#\ufffd\u0012.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\u0017\u0007\"\u0012\ufffd\ufffd\ufffdn\ufffd\ufffd\u001b\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\u0005\ufffd\ufffd\u0014yY\ufffd\u0005\u0016\ufffd$\ufffd\u04ac\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c9f91935b460c8eb3e2defd709f6ca7d5fa902d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd#\ufffd\u0012.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\u0017\u0007\"\u0012\ufffd\ufffd\ufffdn\ufffd\ufffd\u001b\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\u0005\ufffd\ufffd\u0014yY\ufffd\u0005\u0016\ufffd$\ufffd\u04ac\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19371,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\"\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\ufffd\ufffdyY\ufffd\ufffd$\ufffd\u04ac&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:19371 \u00b7 (sonde \/ probe)",
"target_port_label": "19371 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19371,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd#\ufffd\u0012.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\u0017\u0007\"\u0012\ufffd\ufffd\ufffdn\ufffd\ufffd\u001b\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\u0005\ufffd\ufffd\u0014yY\ufffd\u0005\u0016\ufffd$\ufffd\u04ac\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19371,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:19371 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd.\ufffd];\ufffd}\ufffd\ufffd<\ufffd\ufffd\"\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\u017f -1\ufffd\ufffd\ufffdV\ufffdHo\ufffd\ufffd\u023bZX\ufffdh\ufffd\ufffdyY\ufffd\ufffd$\ufffd\u04ac&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19371 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19371"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:19371",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|