|
|
TCP |
79 · FINGER
|
finger
|
Sonde PostgreSQL
postgres probe · via FINGER:79 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 caaddd3ed0a31554
Émulateur
FINGER
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
79
Chemin / cible
—
Service
FINGER
Payload
� �� Β���c4��{s#�H~��By��ʆ� �/�+���� �� / 5� S & $
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� Β���c4��{s#�H~��By��ʆ� �/�+���� ��
/ 5�
S
& $
Requête brute (extrait)
� �� Β���c4��{s#�H~��By��ʆ� �/�+���� �� / 5� S & $�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4c6f67696e3a20686f6e6579706f740d0a4e616d653a20486f6e6579706f7420557365720d0a",
"emulator_response_len": 38,
"bytes_in": 159,
"payload_entropy": 4.727314618761564,
"port_category": "well_known",
"org": "Zenlayer Inc",
"service": "finger",
"app_proto": "finger",
"asn": 21859,
"country": "PT",
"dst_port": 79,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "710fe250b6d580ba07d557c106645703053bcec0",
"event_fingerprint": "ce22a6e6e5ab506a0f5dd67ad1b75eaa26851192",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "finger",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ddc149baa915e33c3f75bbf9f49f0a6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "caaddd3ed0a315543d761490b01b08e0",
"ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "caaddd3ed0a315543d761490b01b08e0",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0",
"tls_ja4_hash": "15b6611f90c03a9f6b2a99be9ffb1608",
"tls_ja4": "t13d0113_5fb62fe3077b_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 13,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 79,
"service": "finger",
"service_name": "finger",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd \u0392\ufffd\ufffd\ufffdc4\u000e\u001b\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdB\u0005y\ufffd\u000f\ufffd\u0286\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd \u0392\ufffd\ufffd\ufffdc4\u000e\u001b\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdB\u0005y\ufffd\u000f\ufffd\u0286\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0001\u0001\u0001\u0003\u0001\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u000f\u0000\u0001\u0001\u0000\u0012\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd \u0392\ufffd\ufffd\ufffdc4\u000e\u001b\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdB\u0005y\ufffd\u000f\ufffd\u0286\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea336481328dfc8a457d61145a3cbf1207af1171",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd \u0392\ufffd\ufffd\ufffdc4\u000e\u001b\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdB\u0005y\ufffd\u000f\ufffd\u0286\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
"tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
"tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"evidence_snippet": "\ufffd\ufffd\ufffd \u0392\ufffd\ufffd\ufffdc4\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdBy\ufffd\ufffd\u0286\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
"attack_vector": "postgres probe \u00b7 via FINGER:79 \u00b7 (sonde \/ probe)",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "finger",
"service_label_fr": "FINGER",
"dst_port": 79,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-finger",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd \u0392\ufffd\ufffd\ufffdc4\u000e\u001b\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdB\u0005y\ufffd\u000f\ufffd\u0286\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
"tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
"tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"attack_vector": "postgres probe \u00b7 via FINGER:79 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd \u0392\ufffd\ufffd\ufffdc4\ufffd\ufffd{s#\ufffdH~\ufffd\ufffdBy\ufffd\ufffd\u0286\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "finger",
"service_banner": "honeypot-finger",
"service_os": "linux",
"dst_port": "79"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "185.180.141.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
79 · FINGER
|
finger
|
Sonde PostgreSQL
postgres probe · via FINGER:79 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 02f32644e1b0655c
Émulateur
FINGER
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
79
Chemin / cible
—
Service
FINGER
Payload
� �o�oG�"�= �Vz�p ��� q�:���y B���� �� / 5� �$�#� � ��(�'��� = < 5 / �� �+�/ � .
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �o�oG�"�=
�Vz�p ��� q�:���y B���� ��
/ 5�
�$�#�
� ��(�'��� = < 5 /
�� �+�/ � .
Requête brute (extrait)
� �o�oG�"�= �Vz�p ��� q�:���y B���� �� / 5� �$�#� � ��(�'��� = < 5 / �� �+�/ � . �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4c6f67696e3a20686f6e6579706f740d0a4e616d653a20486f6e6579706f7420557365720d0a",
"emulator_response_len": 38,
"bytes_in": 162,
"payload_entropy": 4.714105354351413,
"port_category": "well_known",
"org": "Zenlayer Inc",
"service": "finger",
"app_proto": "finger",
"asn": 21859,
"country": "PT",
"dst_port": 79,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "710fe250b6d580ba07d557c106645703053bcec0",
"event_fingerprint": "ce22a6e6e5ab506a0f5dd67ad1b75eaa26851192",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "finger",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "47373bb2fecc5e5b3546e8459dc0d1b5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"ja4": "a3533e7527e047470b74402d4bc8a6dd",
"tls_version": "0x0303",
"tls_cipher_count": 33,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja3": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "a3533e7527e047470b74402d4bc8a6dd",
"tls_ja4": "t13d0133_ad3470b4f447_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 33,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 79,
"service": "finger",
"service_name": "finger",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001ao\b\ufffdoG\ufffd\"\ufffd=\u0012\n\ufffdVz\ufffdp\u0013\u0001\u0000\ufffd\ufffd\ufffd\u001eq\ufffd\u0010:\ufffd\ufffd\ufffdy\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001ao\b\ufffdoG\ufffd\"\ufffd=\u0012\n\ufffdVz\ufffdp\u0013\u0001\u0000\ufffd\ufffd\ufffd\u001eq\ufffd\u0010:\ufffd\ufffd\ufffdy\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\n\u0000\b\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001ao\b\ufffdoG\ufffd\"\ufffd=\u0012\n\ufffdVz\ufffdp\u0013\u0001\u0000\ufffd\ufffd\ufffd\u001eq\ufffd\u0010:\ufffd\ufffd\ufffdy\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e705e72e644e8f8ab651950ca9fb32482825f3c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001ao\b\ufffdoG\ufffd\"\ufffd=\u0012\n\ufffdVz\ufffdp\u0013\u0001\u0000\ufffd\ufffd\ufffd\u001eq\ufffd\u0010:\ufffd\ufffd\ufffdy\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"evidence_snippet": "\ufffd\ufffdo\ufffdoG\ufffd\"\ufffd=\n\ufffdVz\ufffdp\ufffd\ufffd\ufffdq\ufffd:\ufffd\ufffd\ufffdyB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
"attack_vector": "postgres probe \u00b7 via FINGER:79 \u00b7 (sonde \/ probe)",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "finger",
"service_label_fr": "FINGER",
"dst_port": 79,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-finger",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001ao\b\ufffdoG\ufffd\"\ufffd=\u0012\n\ufffdVz\ufffdp\u0013\u0001\u0000\ufffd\ufffd\ufffd\u001eq\ufffd\u0010:\ufffd\ufffd\ufffdy\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
"tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
"tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"attack_vector": "postgres probe \u00b7 via FINGER:79 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdo\ufffdoG\ufffd\"\ufffd=\n\ufffdVz\ufffdp\ufffd\ufffd\ufffdq\ufffd:\ufffd\ufffd\ufffdyB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "finger",
"service_banner": "honeypot-finger",
"service_os": "linux",
"dst_port": "79"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
79 · FINGER
|
finger
|
Botnet Mozi
mozi pattern · via FINGER:79 · (commande & contrôle)
|
Élevée
|
Faible · 37
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
FINGER
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
79
Chemin / cible
—
Service
FINGER
Payload
GET / HTTP/1.1 Host: 62.3.50.33:79 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 37
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:79
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:79 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4c6f67696e3a20686f6e6579706f740d0a4e616d653a20486f6e6579706f7420557365720d0a",
"emulator_response_len": 38,
"bytes_in": 174,
"payload_entropy": 5.321820692143599,
"port_category": "well_known",
"org": "Zenlayer Inc",
"service": "finger",
"app_proto": "finger",
"asn": 21859,
"country": "PT",
"dst_port": 79,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 37,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f45a5ccac0dcec9b1c2cb53afa2e529a7ec097e9",
"event_fingerprint": "f36cf68fa2f3292b1956b06265af6b32f357d9cd",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "finger",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "43350a006a0333601b363429d851495c",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 79,
"service": "finger",
"service_name": "finger",
"risk_score": 37
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b961fc966b6840e47246f2e0f003938d73ccd3b2",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"attack_vector": "mozi pattern \u00b7 via FINGER:79 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0011 \u2014 via FINGER",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "finger",
"service_label_fr": "FINGER",
"dst_port": 79,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-finger",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"port": 79,
"service": "finger",
"service_label_fr": "FINGER"
},
"attack_vector": "mozi pattern \u00b7 via FINGER:79 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:79\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/",
"target_port_label": "79 \u00b7 FINGER",
"emulator_service": "finger",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "finger",
"service_banner": "honeypot-finger",
"service_os": "linux",
"dst_port": "79"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
20547 · PROFINET IO
|
profinet-io
|
profinet probe
profinet probe · via PROFINET IO:20547 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PROFINET-IO
WAF
—
Recommandation
Surveiller
Tags
net_profinet_probe
profinet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20547
Chemin / cible
—
Pourquoi cette classification : Type « profinet_probe » (signaux protocolaires) · confiance 79%
Confiance classification
89%
Corrélation +10
Risque capteur
Faible
· 33
Confiance : Confiance 79 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
Ot Profinet Dcp Get
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742070726f66696e65745f696f20726561647920706f72743d32303534370d0a",
"emulator_response_len": 43,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "profinet-io",
"app_proto": "profinet-io",
"asn": 21859,
"country": "PT",
"dst_port": 20547,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1aca12edf6a46883b06931b983ae14432c6eb19c",
"event_fingerprint": "6045069f16cd1c700b6ad950aa1be9b1f342abf3",
"classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
"confidence": 0.89,
"classification_confidence": 0.89,
"precision_score": 89,
"precision_signals": [
"INT-OT-profinet-dcp-get",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-profinet-dcp-get",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "profinet-io",
"risk_confidence_factor": 79,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "91a3874ab1b56c7604b2303ecb7824d0"
},
"target_context": {
"dst_port": 20547,
"service": "profinet-io",
"service_name": "profinet-io",
"risk_score": 33
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a4b0377a2ca511a41ac6e6d7f046fce69c096a0",
"protocol_details": {
"port": 20547,
"service": "profinet-io",
"service_label_fr": "PROFINET IO"
},
"attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
"target_port_label": "20547 \u00b7 PROFINET IO",
"emulator_service": "profinet-io",
"confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
"classification_reason_label_fr": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 89,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "profinet-io",
"service_label_fr": "PROFINET IO",
"dst_port": 20547,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-profinet-dcp-get",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Profinet Dcp Get",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-profinet-io",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 20547,
"service": "profinet-io",
"service_label_fr": "PROFINET IO"
},
"attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "20547 \u00b7 PROFINET IO",
"emulator_service": "profinet-io",
"confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 89 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "profinet_io",
"service_banner": "honeypot-profinet-io",
"service_os": "linux",
"dst_port": "20547"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "185.180.141.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_profinet_probe",
"profinet_emulated"
]
}
|
|
|
TCP |
7218 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:7218 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0…
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7218
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 44 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7218
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7218 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f",
"http_host_hash": "bbe00d501e59397d9aa58cc796c6d01dd434af44",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 176,
"payload_entropy": 5.312101386722725,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "http",
"app_proto": "http",
"asn": 21859,
"country": "PT",
"dst_port": 7218,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3e3570e278024d88a84f9ea1244036cc0d1d39f6",
"event_fingerprint": "ebe8e4a0dd7693f21e378c7e9165c33e9340257d",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e",
"payload_hash": "b00177f9ba58c2a5beb94b8b1c8bba7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 7218,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0437f577e1d093a0abc182848469f1fa4cb738d2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 7218,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7218 \u00b7 (sonde \/ probe)",
"target_port_label": "7218 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7218,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 7218,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7218 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7218\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"target_port_label": "7218 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7218"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
5672 · AMQP
|
amqp
|
Sonde PostgreSQL
postgres probe · via AMQP:5672 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
AMQP
WAF
—
Recommandation
Surveiller
Tags
amqp_emulated
net_amqp_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5672
Chemin / cible
—
Service
AMQP
Payload
� ���*W�r�_�A |:� �] �C +]d5LGZo_ �$u������a�J5|�?i�,�ϭ�E�Tc?�L� &̨̩�/�0�+�,�� �� � � / 5� L
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���*W�r�_�A |:�
�] �C +]d5LGZo_ �$u������a�J5|�?i�,�ϭ�E�Tc?�L� &̨̩�/�0�+�,�� ��
� � / 5�
L
Requête brute (extrait)
� ���*W�r�_�A |:� �] �C +]d5LGZo_ �$u������a�J5|�?i�,�ϭ�E�Tc?�L� &̨̩�/�0�+�,�� �� � � / 5� L � � http/1.1 + 3����u�4 H�X��s�H���A]��� I�/��+
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "414d515000000901010000000000000e000a000b000000000000000000",
"emulator_response_len": 29,
"bytes_in": 1476,
"payload_entropy": 7.732931571154474,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "amqp",
"app_proto": "amqp",
"asn": 21859,
"country": "PT",
"dst_port": 5672,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "489c29fe54ad0b26a38f0ff4ab5eb7f36f3fdfdb",
"event_fingerprint": "b0beb8729344e0fecf193ea4915355ace522129f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "amqp",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ac7be20b5c492a358a49ca595ca5131",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5672,
"service": "amqp",
"service_name": "amqp",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd*W\ufffdr\u0007\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\u001e\ufffdC\u001f+]d5\u0012LGZo_ \u0011\ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd*W\ufffdr\u0007\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\u001e\ufffdC\u001f+]d5\u0012LGZo_ \u0011\ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001au\ufffd4\u0000H\ufffdX\ufffd\ufffds\ufffdH\ufffd\u0019\ufffd\ufffdA]\ufffd\ufffd\ufffd\u0015\fI\ufffd\/\ufffd\ufffd\u0011\u000e+",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd*W\ufffdr\u0007\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\u001e\ufffdC\u001f+]d5\u0012LGZo_ \u0011\ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a5a39223fa3e7442a794e6d30ec18c805180f45",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd*W\ufffdr\u0007\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\u001e\ufffdC\u001f+]d5\u0012LGZo_ \u0011\ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 5672,
"service": "amqp",
"service_label_fr": "AMQP"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd*W\ufffdr\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\ufffdC+]d5LGZo_ \ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
"attack_vector": "postgres probe \u00b7 via AMQP:5672 \u00b7 (sonde \/ probe)",
"target_port_label": "5672 \u00b7 AMQP",
"emulator_service": "amqp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "amqp",
"service_label_fr": "AMQP",
"dst_port": 5672,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-amqp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd*W\ufffdr\u0007\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\u001e\ufffdC\u001f+]d5\u0012LGZo_ \u0011\ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 5672,
"service": "amqp",
"service_label_fr": "AMQP"
},
"attack_vector": "postgres probe \u00b7 via AMQP:5672 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd*W\ufffdr\ufffd_\ufffdA\t|:\ufffd\r\ufffd]\ufffdC+]d5LGZo_ \ufffd$u\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdJ5|\ufffd?i\ufffd,\ufffd\u03ed\ufffdE\ufffdTc?\ufffdL\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
"target_port_label": "5672 \u00b7 AMQP",
"emulator_service": "amqp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "amqp",
"service_banner": "honeypot-amqp",
"service_os": "linux",
"dst_port": "5672"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "185.180.141.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"amqp_emulated",
"net_amqp_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
5672 · AMQP
|
amqp
|
amqp probe
amqp probe · via AMQP:5672 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
AMQP
WAF
—
Recommandation
Surveiller
Tags
amqp_emulated
http_get_probe
mozi_pattern
net_amqp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5672
Chemin / cible
—
Service
AMQP
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5672 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Pourquoi cette classification : Type « amqp_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5672
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5672 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "414d515000000901010000000000000e000a000b000000000000000000",
"emulator_response_len": 29,
"bytes_in": 176,
"payload_entropy": 5.301305167802895,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "amqp",
"app_proto": "amqp",
"asn": 21859,
"country": "PT",
"dst_port": 5672,
"risk_waf": 8,
"risk_classification": 43,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fe631209a003e52f5f3a29730d903c0af3da1d89",
"event_fingerprint": "b0beb8729344e0fecf193ea4915355ace522129f",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "amqp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ac89b11087c1b39d982dc9d38f810fe",
"path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
},
"target_context": {
"dst_port": 5672,
"service": "amqp",
"service_name": "amqp",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "adc74182f102b851fdee05e2c77b180f5448ec70",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"port": 5672,
"service": "amqp",
"service_label_fr": "AMQP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"attack_vector": "amqp probe \u00b7 via AMQP:5672 \u00b7 (sonde \/ probe)",
"target_port_label": "5672 \u00b7 AMQP",
"emulator_service": "amqp",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "amqp",
"service_label_fr": "AMQP",
"dst_port": 5672,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-amqp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"port": 5672,
"service": "amqp",
"service_label_fr": "AMQP"
},
"attack_vector": "amqp probe \u00b7 via AMQP:5672 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5672\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"target_port_label": "5672 \u00b7 AMQP",
"emulator_service": "amqp",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "amqp",
"service_banner": "honeypot-amqp",
"service_os": "linux",
"dst_port": "5672"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "185.180.141.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"amqp_emulated",
"http_get_probe",
"mozi_pattern",
"net_amqp_probe"
]
}
|
|
|
TCP |
16992 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:16992 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0…
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
16992
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 44 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:16992
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safa
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:16992 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f",
"http_host_hash": "ca472f7222d988e1a7cf102afdf8141c8ae0ae2a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 177,
"payload_entropy": 5.325936805197734,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "http",
"app_proto": "http",
"asn": 21859,
"country": "PT",
"dst_port": 16992,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "81e740fa79018a90db696b9665a67ced1da4dc52",
"event_fingerprint": "7f37cd280682d67f2d5b50aec80f75d03d364603",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e",
"payload_hash": "e3cbbbc33f6e7e4ac739e6508a4c12bf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 16992,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safa",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safa",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safa",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "287c191f3fb47fa55bec2d60dac6ac731464924b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 16992,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safa",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:16992 \u00b7 (sonde \/ probe)",
"target_port_label": "16992 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16992,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
"port": 16992,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:16992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16992\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safa",
"target_port_label": "16992 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
6667 · IRC
|
irc
|
irc probe
irc probe · via IRC:6667 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
irc_emulated
irc_payload
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6667
Chemin / cible
—
Service
IRC
Payload
GET / HTTP/1.1 Host: 62.3.50.33:6667 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Pourquoi cette classification : Type « irc_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6667
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6667 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 176,
"payload_entropy": 5.292012713124487,
"port_category": "registered",
"org": "Zenlayer Inc",
"service": "irc",
"app_proto": "irc",
"asn": 21859,
"country": "PT",
"dst_port": 6667,
"risk_waf": 8,
"risk_classification": 46,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3fd75a4bb65df63055560e5dd335d44e12738444",
"event_fingerprint": "9e2ac318555e178ff4e9bfc08626bc39d4f21eec",
"classification_reason": "Type \u00ab irc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "irc",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PT",
"asn": 21859,
"org": "Zenlayer Inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "60e52af50d7cbc34e844759cb6be8507",
"path_pattern_hash": "744abe26e51e9cc67ce7db92019436c3"
},
"target_context": {
"dst_port": 6667,
"service": "irc",
"service_name": "irc",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"classification_reason": "Type \u00ab irc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca51602fd870bff58eea48cf0b786687c7150ca5",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"port": 6667,
"service": "irc",
"service_label_fr": "IRC"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"attack_vector": "irc probe \u00b7 via IRC:6667 \u00b7 (sonde \/ probe)",
"target_port_label": "6667 \u00b7 IRC",
"emulator_service": "irc",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab irc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "irc",
"service_label_fr": "IRC",
"dst_port": 6667,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"port": 6667,
"service": "irc",
"service_label_fr": "IRC"
},
"attack_vector": "irc probe \u00b7 via IRC:6667 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6667\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
"target_port_label": "6667 \u00b7 IRC",
"emulator_service": "irc",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc",
"service_banner": "honeypot-irc",
"service_os": "linux",
"dst_port": "6667"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"irc_emulated",
"irc_payload",
"mozi_pattern",
"net_irc_probe"
]
}
|