|
|
TCP |
6984 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6984 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4673db83e469a509
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Service
TLS
Payload
� ��7K=���7������ �����KaϬ$ќ+ �-/���^˶an��5�iT)��DK7G�}Q���= <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��7K=���7������ �����KaϬ$ќ+ �-/���^˶an��5�iT)��DK7G�}Q���= <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
� ��7K=���7������ �����KaϬ$ќ+ �-/���^˶an��5�iT)��DK7G�}Q���= <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / l� ��� ) # 8 6 +
Meta JSON brut
{
"tls_ja3_hash": "4673db83e469a509574553048f28e263",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 1530,
"payload_entropy": 7.723310584706107,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 16509,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c06263b270f3929a2b3f866d59dec56d7dac7671",
"event_fingerprint": "769ebb96a5b3819b515ea4f1b65ff259934573dd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4673db83e469a509574553048f28e263",
"payload_hash": "2161233ac00ae6972eefc9754ae043c5",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6984,
"service": "tls",
"service_name": "tls",
"risk_score": 24
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\b\ufffd\u0005\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\ufffd\ufffd\ufffdKa\u0005\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\u000e\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\b\ufffd\u0005\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\ufffd\ufffd\ufffdKa\u0005\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\u000e\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0001\u0000\u0005l\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0018\u0000\u0016\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000)\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00008\u00006\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0007\b\u0000+\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\b\ufffd\u0005\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\ufffd\ufffd\ufffdKa\u0005\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\u000e\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "567a3a49884b82b86293bdccf31a66582002e462",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\b\ufffd\u0005\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\ufffd\ufffd\ufffdKa\u0005\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\u000e\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "4673db83e469a509574553048f28e263",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKa\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=<\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\b\ufffd\u0005\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\ufffd\ufffd\ufffdKa\u0005\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\u000e\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "4673db83e469a509574553048f28e263",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd7K=\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKa\u03ec$\u045c+ \ufffd-\/\ufffd\ufffd\ufffd^\u02f6an\ufffd\ufffd5\ufffdiT)\ufffd\ufffdDK7G\ufffd}Q\ufffd\ufffd\ufffd=<\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6984 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:6984 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4673db83e469a509
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6984
Chemin / cible
—
Service
TLS
Payload
� �!w�@L*<��e�,���)@`@^�aGy�� K��\ R����'�т�7rD��Jb ( <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �!w�@L*<��e�,���)@`@^�aGy�� K��\ R����'�т�7rD��Jb ( <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
� �!w�@L*<��e�,���)@`@^�aGy�� K��\ R����'�т�7rD��Jb ( <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / l� ��� ) # 8 6 +
Meta JSON brut
{
"tls_ja3_hash": "4673db83e469a509574553048f28e263",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 1530,
"payload_entropy": 7.7084055804790195,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "tls",
"app_proto": "tls",
"asn": 16509,
"country": "US",
"dst_port": 6984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c06263b270f3929a2b3f866d59dec56d7dac7671",
"event_fingerprint": "769ebb96a5b3819b515ea4f1b65ff259934573dd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4673db83e469a509574553048f28e263",
"payload_hash": "26ff5189158bf58f83fa003a5ae9ce7f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6984,
"service": "tls",
"service_name": "tls",
"risk_score": 24
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003!w\ufffd@L*\u0010<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`\u0016@^\ufffda\u0018Gy\u0001\ufffd\u001b\u001b\ufffd \u0001K\ufffd\ufffd\\\u001dR\ufffd\ufffd\ufffd\ufffd\u0013\u0015'\u0006\ufffd\u0442\ufffd7rD\ufffd\ufffd\bJb \u001a(\u0018\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003!w\ufffd@L*\u0010<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`\u0016@^\ufffda\u0018Gy\u0001\ufffd\u001b\u001b\ufffd \u0001K\ufffd\ufffd\\\u001dR\ufffd\ufffd\ufffd\ufffd\u0013\u0015'\u0006\ufffd\u0442\ufffd7rD\ufffd\ufffd\bJb \u001a(\u0018\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0001\u0000\u0005l\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0018\u0000\u0016\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0000)\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00008\u00006\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0007\b\u0000+\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003!w\ufffd@L*\u0010<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`\u0016@^\ufffda\u0018Gy\u0001\ufffd\u001b\u001b\ufffd \u0001K\ufffd\ufffd\\\u001dR\ufffd\ufffd\ufffd\ufffd\u0013\u0015'\u0006\ufffd\u0442\ufffd7rD\ufffd\ufffd\bJb \u001a(\u0018\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aedeeec38179eb4636776d095235b0afac5064f5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003!w\ufffd@L*\u0010<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`\u0016@^\ufffda\u0018Gy\u0001\ufffd\u001b\u001b\ufffd \u0001K\ufffd\ufffd\\\u001dR\ufffd\ufffd\ufffd\ufffd\u0013\u0015'\u0006\ufffd\u0442\ufffd7rD\ufffd\ufffd\bJb \u001a(\u0018\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "4673db83e469a509574553048f28e263",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd!w\ufffd@L*<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`@^\ufffdaGy\ufffd\ufffd K\ufffd\ufffd\\R\ufffd\ufffd\ufffd\ufffd'\ufffd\u0442\ufffd7rD\ufffd\ufffdJb (<\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6984,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003!w\ufffd@L*\u0010<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`\u0016@^\ufffda\u0018Gy\u0001\ufffd\u001b\u001b\ufffd \u0001K\ufffd\ufffd\\\u001dR\ufffd\ufffd\ufffd\ufffd\u0013\u0015'\u0006\ufffd\u0442\ufffd7rD\ufffd\ufffd\bJb \u001a(\u0018\u0000<\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "4673db83e469a509574553048f28e263",
"port": 6984,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:6984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd!w\ufffd@L*<\ufffd\ufffde\ufffd,\ufffd\ufffd\ufffd)@`@^\ufffdaGy\ufffd\ufffd K\ufffd\ufffd\\R\ufffd\ufffd\ufffd\ufffd'\ufffd\u0442\ufffd7rD\ufffd\ufffdJb (<\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6984 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|