|
|
TCP |
29840 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:29840 · (reconnaissance)
|
Élevée
|
Moyen · 46
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Protocole
CONNECT / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_dangerous_method
http_method_uncommon
Cible HTTP
CONNECT
/
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
29840
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +6
Risque capteur
Moyen
· 46
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
ET zgrab fingerprint
UA zgrab
Ligne de requête
CONNECT / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
CONNECT / HTTP/1.1
Host: 62.3.50.33:29840
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7b4be00556d7e6bfe311880770d4e1c76ac6f59e",
"http_host_hash": "e349cfa2c3d02d3a90c88d38423dfed5c4b67c1a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 117,
"payload_entropy": 5.186186677634666,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "CA",
"dst_port": 29840,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "59334c34adecd4a48140427c1bbf08f0a6d46ae5",
"event_fingerprint": "1585a64966b7d11d449f9fc4192cc51ad502f3b8",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0594",
"pat-0458"
],
"matched_pattern_names": [
"ET zgrab fingerprint",
"UA zgrab"
],
"pattern_ids": [
"pat-0594",
"pat-0458"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 6
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef60d663d36db05cc1e68077f8a0f3fa",
"payload_hash": "5c584e6188269036cfdf8a41133e48e2",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 29840,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f32b1270950ce393d2344c743eb6e39c2dcd7db0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 29840,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "port scan syn \u00b7 via HTTP:29840 \u00b7 (reconnaissance)",
"target_port_label": "29840 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 6
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 29840,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 29840,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:29840 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29840\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "29840 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +6 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "29840"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
3128,
8080,
22249,
29840,
29842
],
"behavior_alerts": [
"port_scan_campaign"
],
"correlation_confidence_boost": 6,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_dangerous_method",
"http_method_uncommon"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
29842 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:29842 · (reconnaissance)
|
Élevée
|
Moyen · 46
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Protocole
CONNECT / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_dangerous_method
http_method_uncommon
Cible HTTP
CONNECT
/
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
29842
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +6
Risque capteur
Moyen
· 46
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
ET zgrab fingerprint
UA zgrab
Ligne de requête
CONNECT / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
CONNECT / HTTP/1.1
Host: 62.3.50.33:29842
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7b4be00556d7e6bfe311880770d4e1c76ac6f59e",
"http_host_hash": "d8c518bbfdeadfb2f3913a452594c3f8956b4648",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 117,
"payload_entropy": 5.190376634862641,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "CA",
"dst_port": 29842,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ae2dbc57d54dfcb5aef1c9f33c89d3ded621e39b",
"event_fingerprint": "b9661e74c26810d70a08e07055bf6cd2d4c73531",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0594",
"pat-0458"
],
"matched_pattern_names": [
"ET zgrab fingerprint",
"UA zgrab"
],
"pattern_ids": [
"pat-0594",
"pat-0458"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 6
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef60d663d36db05cc1e68077f8a0f3fa",
"payload_hash": "c0e60cfecaa23c7e53e202f679d505ab",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 29842,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e881f4995585b1e3a92daf41ca1aa8e0011e2f0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 29842,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "port scan syn \u00b7 via HTTP:29842 \u00b7 (reconnaissance)",
"target_port_label": "29842 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 6
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 29842,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 29842,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:29842 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:29842\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "29842 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +6 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "29842"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
3128,
8080,
22249,
29842
],
"behavior_alerts": [
"port_scan_campaign"
],
"correlation_confidence_boost": 6,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_dangerous_method",
"http_method_uncommon"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22249 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:22249 · (reconnaissance)
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
CONNECT / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_dangerous_method
http_method_uncommon
Cible HTTP
CONNECT
/
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
22249
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
ET zgrab fingerprint
UA zgrab
Ligne de requête
CONNECT / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
CONNECT / HTTP/1.1
Host: 62.3.50.33:22249
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7b4be00556d7e6bfe311880770d4e1c76ac6f59e",
"http_host_hash": "0a0d5cef5573d14b087cd895cde1a0cb1e278a22",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 117,
"payload_entropy": 5.162640630607628,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "CA",
"dst_port": 22249,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 47,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "15dea7c5d80be0c87a276bbc91b1448739228d82",
"event_fingerprint": "96b1b6b94c220c48f573917fc17ef3c29790b0df",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0594",
"pat-0458"
],
"matched_pattern_names": [
"ET zgrab fingerprint",
"UA zgrab"
],
"pattern_ids": [
"pat-0594",
"pat-0458"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef60d663d36db05cc1e68077f8a0f3fa",
"payload_hash": "98fafc07045a0e084f946ba4a12e2261",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 22249,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a30caba3285017033b4896ffd9cf78069b880802",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 22249,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "port scan syn \u00b7 via HTTP:22249 \u00b7 (reconnaissance)",
"target_port_label": "22249 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 22249,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 22249,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:22249 \u00b7 (reconnaissance)",
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:22249\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "22249 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "22249"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_dangerous_method",
"http_method_uncommon"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_dangerous_method
http_method_uncommon
Cible HTTP
CONNECT
/
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0594
pat-0458
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ET zgrab fingerprint
UA zgrab
Ligne de requête
CONNECT / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
CONNECT / HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7b4be00556d7e6bfe311880770d4e1c76ac6f59e",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 116,
"payload_entropy": 5.128166586658269,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "CA",
"dst_port": 8080,
"risk_waf": 44,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ba1909eb7a8ee56fbe2ff85dbac1b663166f946e",
"event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 108,
"precision_signals": [
"pat-0594",
"pat-0458"
],
"kb_rule_ids": [
"pat-0594",
"pat-0458"
],
"matched_patterns": [
"pat-0594",
"pat-0458"
],
"matched_pattern_names": [
"ET zgrab fingerprint",
"UA zgrab"
],
"pattern_ids": [
"pat-0594",
"pat-0458"
],
"confidence_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef60d663d36db05cc1e68077f8a0f3fa",
"payload_hash": "8f4bf368d74841b7d5290cf422caeceb",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4d21735cce0105b7526c775701818e3be13cbf7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0594",
"pat-0458"
],
"tags_summary_labels_fr": [
"pat-0594",
"pat-0458"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_dangerous_method",
"http_method_uncommon",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3128 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:3128 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
http_dangerous_method
http_method_uncommon
Cible HTTP
CONNECT
/
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
3128
Chemin / cible
/
Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0594
pat-0458
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ET zgrab fingerprint
UA zgrab
Ligne de requête
CONNECT / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
CONNECT / HTTP/1.1
Host: 62.3.50.33:3128
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7b4be00556d7e6bfe311880770d4e1c76ac6f59e",
"http_host_hash": "0004f205c8c9eec39df22e7d5c19060a1bc84a1b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 116,
"payload_entropy": 5.135535146764074,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "CA",
"dst_port": 3128,
"risk_waf": 44,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a0e49462522d0a55b936319d5059260f039bc00d",
"event_fingerprint": "09a420f4f87817ff102ef98d124f77ba61aa55c1",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 108,
"precision_signals": [
"pat-0594",
"pat-0458"
],
"kb_rule_ids": [
"pat-0594",
"pat-0458"
],
"matched_patterns": [
"pat-0594",
"pat-0458"
],
"matched_pattern_names": [
"ET zgrab fingerprint",
"UA zgrab"
],
"pattern_ids": [
"pat-0594",
"pat-0458"
],
"confidence_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef60d663d36db05cc1e68077f8a0f3fa",
"payload_hash": "f60cb4ab2394b2bcd050fa7bdb473be0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "CONNECT",
"path": "\/",
"user_agent": "Mozilla\/5.0 zgrab\/0.x",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "CONNECT \/ HTTP\/1.1",
"request_sample": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bc8f253b65e5658f78e405bed60d4ed386590de",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "scanner vuln \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe)",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 44,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"pat-0594",
"pat-0458"
],
"tags_summary_labels_fr": [
"pat-0594",
"pat-0458"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "\/",
"request_line": "CONNECT \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 zgrab\/0.x",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe)",
"evidence_snippet": "CONNECT \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_dangerous_method",
"http_method_uncommon",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|