Détails IP 172.238.246.191

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

exploit_attempt

Comparaison ASN / FAI

ASN 63949 · 172.238.240.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 13 événements sur la période pour cette IP.

45.33.70.184 Sonde port 18/07/2026 21:59 UTC
45.33.90.191 Sonde port 18/07/2026 21:22 UTC
170.187.145.59 Sonde port 18/07/2026 21:16 UTC
170.187.147.240 Sonde port 18/07/2026 20:42 UTC
139.177.194.207 Sonde port 18/07/2026 20:25 UTC
198.58.111.250 Sonde port 18/07/2026 20:13 UTC
80.85.84.68 citrix ica probe 18/07/2026 19:43 UTC
23.239.29.212 Sonde port 18/07/2026 19:40 UTC

IPs apparentées

Même FAI Akamai Connected Cloud — corrélation indicative.

45.33.70.184 Sonde port
45.33.90.191 Sonde port
170.187.145.59 Sonde port
170.187.147.240 Sonde port
139.177.194.207 Sonde port

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

IEC104 TCP 10 HTTP TCP 3

IEC104

10

HTTP

3

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

13 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 18:25:49 UTC	TCP	8084 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:8084 · (tentative d'exploit)	—	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8084 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 62% Risque capteur Moyen · 53 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8084 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8084 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "29eb7064ac60b6748d87727e5ef8f5ef636716fb", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 202, "payload_entropy": 5.402576443532629, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "http", "app_proto": "http", "asn": 63949, "country": "SE", "dst_port": 8084, "risk_waf": 72, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4dcbeae7e50d8a691f6670393a93509e80d866a5", "event_fingerprint": "ebc906b0f0074f27e2e4f93dcdc76e075f5acfe4", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0bec5af24b825fe0d2d2fc2d22b46622", "payload_hash": "6fbf60fb79d3cd3f5885e6e862bafe4a", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a0e0ebd2cba411f57097a96d9a5962c2f08807a7", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "exploit attempt \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit)", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP", "confidence_pct": 62, "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
18/07/2026 04:05:57 UTC	TCP	8085 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:8085 · (tentative d'exploit)	—	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 62% Risque capteur Moyen · 53 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "29eb7064ac60b6748d87727e5ef8f5ef636716fb", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 202, "payload_entropy": 5.398344993174839, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "http", "app_proto": "http", "asn": 63949, "country": "SE", "dst_port": 8085, "risk_waf": 72, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "9269fbc73faf84ae739a4cd696c041e500aa4102", "event_fingerprint": "0fcaa6a995d1cdf34f87aa636ef596625b2ef958", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0bec5af24b825fe0d2d2fc2d22b46622", "payload_hash": "4bfc031264f360f10c9434df47211761", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "beed5e8f5c27ac1728aed44b94ae51278b849584", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "exploit attempt \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit)", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP", "confidence_pct": 62, "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload �� sI�bd��~snJJ��K"��1��M -��4YNk��˲z/��Q�l�� W��A��=5��</ ��̨�w Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �� sI�bd��~snJJ��K"��1��M -��4YNk��˲z/��Q�l�� W��A��=5��</ ��̨�w Requête brute (extrait) �� sI�bd��~snJJ��K"��1��M -��4YNk��˲z/��Q�l�� W��A��=5��</ ��̨�w�v�a�`�0�(��/�'��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 424, "payload_entropy": 5.9725428404519185, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "be439875fa2462be325e643473804d81", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003 \ufffdsI\ufffdbd\b\ufffd\ufffd\ufffd\ufffd~s\u0002nJJ\ufffd\ufffd\u0006\u0012K\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\u001f\ufffdQ\ufffd\u000e\u0015\u0001l\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003 \ufffdsI\ufffdbd\b\ufffd\ufffd\ufffd\ufffd~s\u0002nJJ\ufffd\ufffd\u0006\u0012K\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\u001f\ufffdQ\ufffd\u000e\u0015\u0001l\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003 \ufffdsI\ufffdbd\b\ufffd\ufffd\ufffd\ufffd~s\u0002nJJ\ufffd\ufffd\u0006\u0012K\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\u001f\ufffdQ\ufffd\u000e\u0015\u0001l\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "96fe1075e5668047ee8112c26830b1e0f6294b71", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003 \ufffdsI\ufffdbd\b\ufffd\ufffd\ufffd\ufffd~s\u0002nJJ\ufffd\ufffd\u0006\u0012K\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\u001f\ufffdQ\ufffd\u000e\u0015\u0001l\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd \ufffdsI\ufffdbd\ufffd\ufffd\ufffd\ufffd~snJJ\ufffd\ufffdK\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\ufffdQ\ufffdl\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003 \ufffdsI\ufffdbd\b\ufffd\ufffd\ufffd\ufffd~s\u0002nJJ\ufffd\ufffd\u0006\u0012K\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\u001f\ufffdQ\ufffd\u000e\u0015\u0001l\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd \ufffdsI\ufffdbd\ufffd\ufffd\ufffd\ufffd~snJJ\ufffd\ufffdK\"\ufffd\ufffd\ufffd1\ufffd\ufffdM -\ufffd\ufffd4YNk\ufffd\ufffd\u02f2z\/\ufffd\ufffd\ufffdQ\ufffdl\ufffd\ufffd\t\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload TP2Lo�� u�m�l2Nt.l��S��LRxY �l�E�󝛫�-�A+"Ddd��gnC��4E�DF��̩�s�r�,��$� �+��#� ��E� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) TP2Lo�� u�m�l2Nt.l��S��LRxY �l�E�󝛫�-�A+"Ddd��gnC��4E�DF��̩�s�r�,��$� �+��#� ��E� Requête brute (extrait) TP2Lo�� u�m�l2Nt.l��S��LRxY �l�E�󝛫�-�A+"Ddd��gnC��4E�DF��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� #<:http/0.9http/1.0http/1.1spdy/1spdy/2 Meta JSON brut { "protocol_emulated": true, "bytes_in": 345, "payload_entropy": 6.0515308931987475, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "999b562eaafac42733687a7041cacc31", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u00172L\u0006o\ufffd\u0007\ufffd\n\u001fu\u0002\ufffdm\ufffdl\u00122Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"\u0016Ddd\ufffd\ufffdgn\u0003C\ufffd\u0004\ufffd4E\ufffdD\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u00172L\u0006o\ufffd\u0007\ufffd\n\u001fu\u0002\ufffdm\ufffdl\u00122Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"\u0016Ddd\ufffd\ufffdgn\u0003C\ufffd\u0004\ufffd4E\ufffdD\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2", "payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u00172L\u0006o\ufffd\u0007\ufffd\n\u001fu\u0002\ufffdm\ufffdl\u00122Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"\u0016Ddd\ufffd\ufffdgn\u0003C\ufffd\u0004\ufffd4E\ufffdD\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "84044ab601998194829d5d1914129e35c6152bdd", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u00172L\u0006o\ufffd\u0007\ufffd\n\u001fu\u0002\ufffdm\ufffdl\u00122Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"\u0016Ddd\ufffd\ufffdgn\u0003C\ufffd\u0004\ufffd4E\ufffdD\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "TP2Lo\ufffd\ufffd\nu\ufffdm\ufffdl2Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"Ddd\ufffd\ufffdgnC\ufffd\ufffd4E\ufffdDF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u00172L\u0006o\ufffd\u0007\ufffd\n\u001fu\u0002\ufffdm\ufffdl\u00122Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"\u0016Ddd\ufffd\ufffdgn\u0003C\ufffd\u0004\ufffd4E\ufffdD\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "TP2Lo\ufffd\ufffd\nu\ufffdm\ufffdl2Nt.l\ufffd\ufffdS\ufffd\ufffd\ufffdLRxY \ufffdl\ufffdE\ufffd\udb35\udeeb\ufffd-\ufffdA+\"Ddd\ufffd\ufffdgnC\ufffd\ufffd4E\ufffdDF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload FBV��.$�\�~��e4�� hh��~�o �p��C�(^ �7!`ƽ,f��تL\�L��v�D��'�/��(�0�`�a�v�w̨�� /<��5=�� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) FBV��.$�\�~��e4�� hh��~�o �p��C�(^ �7!`ƽ,f��تL\�L��v�D��'�/��(�0�`�a�v�w̨�� /<��5=�� Requête brute (extrait) FBV��.$�\�~��e4�� hh��~�o �p��C�(^ �7!`ƽ,f��تL\�L��v�D��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� #0.http/0.9http/1.0spdy/1spdy/2spdy/3h2c Meta JSON brut { "protocol_emulated": true, "bytes_in": 331, "payload_entropy": 5.971337080693239, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b15fd20e912322efa85feec50b6833ea", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003V\ufffd\u0011\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nh\u0003\u0001h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffd\u000eC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003V\ufffd\u0011\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nh\u0003\u0001h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffd\u000eC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c", "payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003V\ufffd\u0011\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nh\u0003\u0001h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffd\u000eC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "29b6f6765679ee8ea53f0e6994e11c2595616e69", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003V\ufffd\u0011\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nh\u0003\u0001h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffd\u000eC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "FBV\ufffd\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nhh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffdC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003V\ufffd\u0011\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nh\u0003\u0001h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffd\u000eC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "FBV\ufffd\ufffd.$\ufffd\\\ufffd~\ufffd\ufffde4\ufffd\ufffd\nhh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdo \ufffdp\ufffd\ufffd\ufffdC\ufffd(^\t\ufffd7!`\u01bd,f\ufffd\ufffd\ufffd\u062aL\\\ufffdL\ufffd\ufffdv\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��3f"/��7F�Bk�"��mC^�K��\|�� y�S%H��6��-X ��hsm��\���'��/��(̩�0�s�`�r�a�,�v��w��̨�$ Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��3f"/��7F�Bk�"��mC^�K��\|�� y�S%H��6��-X ��hsm��\���'��/��(̩�0�s�`�r�a�,�v��w��̨�$ Requête brute (extrait) ��3f"/��7F�Bk�"��mC^�K��\|�� y�S%H��6��-X ��hsm��\���'��/��(̩�0�s�`�r�a�,�v��w��̨�$� �+��# � /�<��5E=��kA9��g3�JJ 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 412, "payload_entropy": 5.992969935931149, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "72807bb45cb16621143f0bc899ca3342", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3f\"\/\ufffd\ufffd7F\ufffd\u000eB\u0016k\u0010\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\u0003\|\ufffd\ufffd y\ufffdS\b%\u001bH\ufffd\u0005\ufffd6\ufffd\ufffd\u0007\ufffd-\u001eX\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\u0000\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3f\"\/\ufffd\ufffd7F\ufffd\u000eB\u0016k\u0010\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\u0003\|\ufffd\ufffd y\ufffdS\b%\u001bH\ufffd\u0005\ufffd6\ufffd\ufffd\u0007\ufffd-\u001eX\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\u0000\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdJJ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3f\"\/\ufffd\ufffd7F\ufffd\u000eB\u0016k\u0010\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\u0003\|\ufffd\ufffd y\ufffdS\b%\u001bH\ufffd\u0005\ufffd6\ufffd\ufffd\u0007\ufffd-\u001eX\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\u0000\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c9d7e63a2dc128dc4fbb04736c36753f97e40d15", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3f\"\/\ufffd\ufffd7F\ufffd\u000eB\u0016k\u0010\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\u0003\|\ufffd\ufffd y\ufffdS\b%\u001bH\ufffd\u0005\ufffd6\ufffd\ufffd\u0007\ufffd-\u001eX\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\u0000\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd\ufffd3f\"\/\ufffd\ufffd7F\ufffdBk\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\|\ufffd\ufffd y\ufffdS%H\ufffd\ufffd6\ufffd\ufffd\ufffd-X\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd3f\"\/\ufffd\ufffd7F\ufffd\u000eB\u0016k\u0010\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\u0003\|\ufffd\ufffd y\ufffdS\b%\u001bH\ufffd\u0005\ufffd6\ufffd\ufffd\u0007\ufffd-\u001eX\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\u0000\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd3f\"\/\ufffd\ufffd7F\ufffdBk\ufffd\"\ufffd\ufffd\ufffdmC^\ufffdK\ufffd\ufffd\ufffd\|\ufffd\ufffd y\ufffdS%H\ufffd\ufffd6\ufffd\ufffd\ufffd-X\r\ufffd\ufffd\ufffd\ufffd\ufffdhsm\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��}(��L0v-��@�ފ3�,�3� <�EK$5��۵��#��)$'��\ѷ�+\|�3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��}(��L0v-��@�ފ3�,�3� <�EK$5��۵��#��)$'��\ѷ�+\|�3g��9k��E�� #��+� �$�� Requête brute (extrait) ��}(��L0v-��@�ފ3�,�3� <�EK$5��۵��#��)$'��\ѷ�+\|�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 413, "payload_entropy": 6.027417465975616, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dec988ff85d61b91929ec90bc53ba81d", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\ufffd}(\u0005\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\u0003\ufffd,\ufffd\u00073\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd\u000e#\ufffd\ufffd)$'\ufffd\ufffd\u001f\ufffd\\\u0477\ufffd\u0018+\|\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\ufffd}(\u0005\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\u0003\ufffd,\ufffd\u00073\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd\u000e#\ufffd\ufffd)$'\ufffd\ufffd\u001f\ufffd\\\u0477\ufffd\u0018+\|\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\ufffd}(\u0005\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\u0003\ufffd,\ufffd\u00073\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd\u000e#\ufffd\ufffd)$'\ufffd\ufffd\u001f\ufffd\\\u0477\ufffd\u0018+\|\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3cd46ddd84ba40e842ffd188a12c125f132520b", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\ufffd}(\u0005\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\u0003\ufffd,\ufffd\u00073\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd\u000e#\ufffd\ufffd)$'\ufffd\ufffd\u001f\ufffd\\\u0477\ufffd\u0018+\|\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}(\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\ufffd,\ufffd3\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd)$'\ufffd\ufffd\ufffd\\\u0477\ufffd+\|\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\ufffd}(\u0005\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\u0003\ufffd,\ufffd\u00073\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd\u000e#\ufffd\ufffd)$'\ufffd\ufffd\u001f\ufffd\\\u0477\ufffd\u0018+\|\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}(\ufffd\ufffdL0v-\ufffd\ufffd@\ufffd\u078a3\ufffd,\ufffd3\ufffd <\ufffdEK$5\ufffd\ufffd\u06f5\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd)$'\ufffd\ufffd\ufffd\\\u0477\ufffd+\|\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��\|"�\|�^"�2�T r�� 8�~G��7( � ��ۧ?ն��ۧ36�z�#��p��3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\|"�\|�^"�2�T r�� 8�~G��7( ��ۧ?ն��ۧ36�z�#��p��3g��9k��E�� #��+� �$�� Requête brute (extrait) ��\|"�\|�^"�2�T r�� 8�~G��7( � ��ۧ?ն��ۧ36�z�#��p��3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 426, "payload_entropy": 5.998195814413519, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7c77770879716a4ba5fce3f1000fa2d5", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\|\"\ufffd\|\ufffd^\u001e\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd\u00187( \ufffd\f\u0000\ufffd\ufffd\ufffd\u06e7?\u0576\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\u0007\ufffd\ufffdp\u0015\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\|\"\ufffd\|\ufffd^\u001e\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd\u00187( \ufffd\f\u0000\ufffd\ufffd\ufffd\u06e7?\u0576\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\u0007\ufffd\ufffdp\u0015\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\|\"\ufffd\|\ufffd^\u001e\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd\u00187( \ufffd\f\u0000\ufffd\ufffd\ufffd\u06e7?\u0576\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\u0007\ufffd\ufffdp\u0015\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ae4595180529e145612c8a84d2437855323f935f", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\|\"\ufffd\|\ufffd^\u001e\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd\u00187( \ufffd\f\u0000\ufffd\ufffd\ufffd\u06e7?\u0576\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\u0007\ufffd\ufffdp\u0015\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd\ufffd\|\"\ufffd\|\ufffd^\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd7( \ufffd\ufffd\ufffd\ufffd\u06e7?\u0576\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\ufffd\ufffdp\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\|\"\ufffd\|\ufffd^\u001e\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd\u00187( \ufffd\f\u0000\ufffd\ufffd\ufffd\u06e7?\u0576\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\u0007\ufffd\ufffdp\u0015\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\|\"\ufffd\|\ufffd^\"\ufffd2\ufffdT\tr\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd8\ufffd~G\ufffd\ufffd7( \ufffd\ufffd\ufffd\ufffd\u06e7?\u0576\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u06e736\ufffdz\ufffd#\ufffd\ufffdp\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��U��k��09�k�Z\��g��Um�� ^Y:�f�,��m��3�pd��A��=5��</ ��̨�w Pourquoi cette classification :* Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��U��k��09�k�Z\��g��Um�� ^Y:�f�,��m��3�pd��A��=5��</ ��̨�w Requête brute (extrait) ��U��k��09�k�Z\��g��Um�� ^Y:�f�,��m��3�pd��A��=5��</ ��̨�w�v�a�`�0�(��/�'��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 426, "payload_entropy": 6.017362004639759, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "223b1e5f6ee4bcb0c554c890daffb9d3", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdU\ufffd\u001c\ufffdk\ufffd\u0000\ufffd\ufffd\u001109\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\u001e\ufffd\ufffd\ufffd \ufffd\ufffd^\u0014Y:\ufffdf\ufffd\u0002,\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\u001a\ufffd\ufffd\ufffd\u001d\ufffdm\ufffd\ufffd3\ufffdpd\u001c\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdU\ufffd\u001c\ufffdk\ufffd\u0000\ufffd\ufffd\u001109\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\u001e\ufffd\ufffd\ufffd \ufffd\ufffd^\u0014Y:\ufffdf\ufffd\u0002,\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\u001a\ufffd\ufffd\ufffd\u001d\ufffdm\ufffd\ufffd3\ufffdpd\u001c\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdU\ufffd\u001c\ufffdk\ufffd\u0000\ufffd\ufffd\u001109\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\u001e\ufffd\ufffd\ufffd \ufffd\ufffd^\u0014Y:\ufffdf\ufffd\u0002,\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\u001a\ufffd\ufffd\ufffd\u001d\ufffdm\ufffd\ufffd3\ufffdpd\u001c\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b7e87f4684caba9b7f0f434b415a56806d28211", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdU\ufffd\u001c\ufffdk\ufffd\u0000\ufffd\ufffd\u001109\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\u001e\ufffd\ufffd\ufffd \ufffd\ufffd^\u0014Y:\ufffdf\ufffd\u0002,\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\u001a\ufffd\ufffd\ufffd\u001d\ufffdm\ufffd\ufffd3\ufffdpd\u001c\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd\ufffdU\ufffd\ufffdk\ufffd\ufffd\ufffd09\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd^Y:\ufffdf\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd3\ufffdpd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdU\ufffd\u001c\ufffdk\ufffd\u0000\ufffd\ufffd\u001109\ufffdk\ufffdZ\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\u001e\ufffd\ufffd\ufffd \ufffd\ufffd^\u0014Y:\ufffdf\ufffd\u0002,\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd\u001a\ufffd\ufffd\ufffd\u001d\ufffdm\ufffd\ufffd3\ufffdpd\u001c\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdU\ufffd\ufffdk\ufffd\ufffd\ufffd09\ufffdk\ufffdZ*\\\ufffd\ufffdg\ufffd\ufffd\ufffdUm\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd^Y:\ufffdf\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd3\ufffdpd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��JG�\H�$rN��'�r��+cx�v۱yׂb�' \|As�u�c��#:��\s۶^�KPƷ��3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��JG�\H�$rN��'�r��+cx�v۱yׂb�' \|As�u�c��#:��\s۶^�KPƷ��3g��9k��E�� #��+� �$�� Requête brute (extrait) ��JG�\H�$rN��'�r��+cx�v۱yׂb�' \|As�u�c��#:��\s۶^�KPƷ��3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 416, "payload_entropy": 5.9860320267740486, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5929f0b1841880da288d56b333969baf", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003JG\ufffd\u001a\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \u0004\|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\u0004\ufffdKP\u0001\u01b7\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003JG\ufffd\u001a\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \u0004\|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\u0004\ufffdKP\u0001\u01b7\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003JG\ufffd\u001a\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \u0004\|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\u0004\ufffdKP\u0001\u01b7\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "48fdb9a8521bf7f7d198e23886294a5a763091d3", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003JG\ufffd\u001a\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \u0004\|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\u0004\ufffdKP\u0001\u01b7\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffdJG\ufffd\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\ufffdKP\u01b7\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003JG\ufffd\u001a\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \u0004\|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\u0004\ufffdKP\u0001\u01b7\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdJG\ufffd\\H\ufffd$rN\ufffd\ufffd'\ufffdr\ufffd\ufffd\ufffd+cx\ufffdv\u06f1y\u05c2b\ufffd' \|As\ufffdu\ufffdc\ufffd\ufffd#:\ufffd\ufffd\ufffd\ufffd\\s\u06f6^\ufffdKP\u01b7\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:36 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��O�N��M�铤��G(��D�ē~oP#��^ 1>�2#.r��vq�;��+�.[b��ʱ��A�v�zz��'��/��(̩�0�s�`�r�a�,�v��w��̨�$ Pourquoi cette classification :* Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��O�N��M�铤��G(��D�ē~oP#��^ 1>�2#.r��vq�;��+�.[b��ʱ��A�v�zz��'��/��(̩�0�s�`�r�a�,�v��w��̨�$ Requête brute (extrait) ��O�N��M�铤��G(��D�ē~oP#��^ 1>�2#.r��vq�;��+�.[b��ʱ��A�v�zz��'��/��(̩�0�s�`�r�a�,�v��w��̨�$� �+��# � /�<��5E=��kA9��g3�� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 439, "payload_entropy": 5.992507475155579, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c7c3b125d93265fef83b193b734b0c9", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG\u001b(\ufffd\ufffd\u0015D\ufffd\u0113~\u001boP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\u0013\ufffd;\ufffd\ufffd+\u0015\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG\u001b(\ufffd\ufffd\u0015D\ufffd\u0113~\u001boP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\u0013\ufffd;\ufffd\ufffd+\u0015\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG\u001b(\ufffd\ufffd\u0015D\ufffd\u0113~\u001boP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\u0013\ufffd;\ufffd\ufffd+\u0015\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c3cd94b7694ffd42ce013bdcc30119afb9f0c67", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG\u001b(\ufffd\ufffd\u0015D\ufffd\u0113~\u001boP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\u0013\ufffd;\ufffd\ufffd+\u0015\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffdO\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG(\ufffd\ufffdD\ufffd\u0113~oP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\ufffd;\ufffd\ufffd+\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\ufffdzz\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003O\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG\u001b(\ufffd\ufffd\u0015D\ufffd\u0113~\u001boP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\u0013\ufffd;\ufffd\ufffd+\u0015\ufffd.[b\ufffd\ufffd\u02b1\ufffd\ufffdA\ufffdv\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdO\ufffdN\ufffd\ufffdM\ufffd\u94e4\ufffd\ufffd\ufffdG(\ufffd\ufffdD\ufffd\u0113~oP#\ufffd\ufffd^ 1>\ufffd2#.r\ufffd\ufffdvq\ufffd;\ufffd\ufffd+\ufffd.[b\ufffd*\ufffd\u02b1\ufffd\ufffdA\ufffdv\ufffdzz\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
17/07/2026 13:33:35 UTC	TCP	2404 · IEC104	iec104	Sonde IEC 104 (SCADA) iec104 probe · via IEC104:2404 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur IEC104 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2404 Chemin / cible — Service IEC104 Payload ��1� =��B��I��d5�;�}��( �\Wc�܋�El�POp^�5~��̪��A�3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « iec104_probe » (signaux protocolaires) · confiance 81% Confiance classification 81% Risque capteur Faible · 33 Confiance : Confiance 81 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Ot Iec104 Startdt Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��1� =��B��I��d5�;�}��( �\Wc�܋�El�POp^�5~��̪��A�3g��9k��E�� #��+� �$�� Requête brute (extrait) ��1� =��B��I��d5�;�}��( �\Wc�܋�El�POp^�5~��̪��A�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "protocol_emulated": true, "bytes_in": 424, "payload_entropy": 5.9328633764104834, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "iec104", "app_proto": "iec104", "asn": 63949, "country": "SE", "dst_port": 2404, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1e169d60097e1e9b97bd241ca925ecff0beec25c", "event_fingerprint": "99a3fe3e3c5461b3e77b1a9b4d0c23a3bc42c21f", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "confidence": 0.81, "classification_confidence": 0.81, "precision_score": 91, "precision_signals": [ "INT-OT-iec104-startdt", "INT-upstream" ], "kb_rule_ids": [ "INT-OT-iec104-startdt", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "iec104", "risk_confidence_factor": 81, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ffaaa7409c340483383c0cec249741c9", "path_pattern_hash": "09bd81a4aaa94733fb840e5e256406fa" }, "target_context": { "dst_port": 2404, "service": "iec104", "service_name": "iec104", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd1\ufffd =\ufffd\ufffdB\u000f\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd\u0016;\ufffd}\u0001\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffd\u0013El\ufffdPOp^\u0002\u0016\ufffd5~\ufffd\ufffd\ufffd\u032a\u001d\ufffd\ufffd\ufffdA\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd1\ufffd =\ufffd\ufffdB\u000f\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd\u0016;\ufffd}\u0001\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffd\u0013El\ufffdPOp^\u0002\u0016\ufffd5~\ufffd\ufffd\ufffd\u032a\u001d\ufffd\ufffd\ufffdA\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd1\ufffd =\ufffd\ufffdB\u000f\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd\u0016;\ufffd}\u0001\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffd\u0013El\ufffdPOp^\u0002\u0016\ufffd5~\ufffd\ufffd\ufffd\u032a\u001d\ufffd\ufffd\ufffdA\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe", "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "572af347d932c7ebf9558f169232e7c5395aca7f", "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd1\ufffd =\ufffd\ufffdB\u000f\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd\u0016;\ufffd}\u0001\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffd\u0013El\ufffdPOp^\u0002\u0016\ufffd5~\ufffd\ufffd\ufffd\u032a\u001d\ufffd\ufffd\ufffdA\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd =\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd;\ufffd}\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffdEl\ufffdPOp^\ufffd5~\ufffd\ufffd\ufffd\u032a\ufffd\ufffd\ufffdA\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "classification_reason_label_fr": "Type \u00ab iec104_probe \u00bb (signaux protocolaires) \u00b7 confiance 81%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 81, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "iec104", "service_label_fr": "IEC104", "dst_port": 2404, "protocol_emulated": true, "tags_summary": [ "INT-OT-iec104-startdt", "INT-upstream" ], "tags_summary_labels_fr": [ "Ot Iec104 Startdt", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-iec104", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "iec104_probe_fr": "Protocole IEC 60870-5-104 (STARTDT)", "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd1\ufffd =\ufffd\ufffdB\u000f\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd\u0016;\ufffd}\u0001\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffd\u0013El\ufffdPOp^\u0002\u0016\ufffd5~\ufffd\ufffd\ufffd\u032a\u001d\ufffd\ufffd\ufffdA\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 2404, "service": "iec104", "service_label_fr": "IEC104" }, "attack_vector": "iec104 probe \u00b7 via IEC104:2404 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd =\ufffd\ufffdB\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffdd5\ufffd;\ufffd}\ufffd\ufffd( \ufffd\\Wc\ufffd\u070b\ufffdEl\ufffdPOp^\ufffd5~\ufffd\ufffd\ufffd\u032a\ufffd\ufffd\ufffdA\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "2404 \u00b7 IEC104", "emulator_service": "iec104", "confidence_reason": "Confiance 81 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 81 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "iec104", "service_banner": "honeypot-iec104", "service_os": "linux", "dst_port": "2404" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "iec104_emulated", "net_iec104_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
16/07/2026 20:12:51 UTC	TCP	8001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:8001 · (tentative d'exploit)	—	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 62% Risque capteur Moyen · 50 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "29eb7064ac60b6748d87727e5ef8f5ef636716fb", "http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 202, "payload_entropy": 5.388765446473209, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "http", "app_proto": "http", "asn": 63949, "country": "SE", "dst_port": 8001, "risk_waf": 72, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7095accd48672777d0b04080e74b3cd7450ee662", "event_fingerprint": "9d6a318ce652902314c6341b2bb6c2bcca4647fd", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SE", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0bec5af24b825fe0d2d2fc2d22b46622", "payload_hash": "3516dd039860e0f3da5e25b9ed8e4c9b", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8001, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "de30a970236559c0b9fec1da144b251dc21c4686", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "exploit attempt \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit)", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP", "confidence_pct": 62, "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 50 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/108.0.0.0 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

172.238.246.191

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence