|
|
TCP |
5079 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5079 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5079
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=ef6a7 Call-ID: 6528085afd2140709e6125207bc9c2e2 CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.495787677594213,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5079,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ca0ec8f64d1dd1bdc1c9892c056d397ed3e1055a",
"event_fingerprint": "a7072d7f6ac57909738ed5f9032db030e6491c3c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "6f589145b60b6baf8824f557edb6360a",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5079,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ef6a7\r\nCall-ID: 6528085afd2140709e6125207bc9c2e2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ef6a7\r\nCall-ID: 6528085afd2140709e6125207bc9c2e2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab9c402bcf1a2a392a197638a9e2e3c90b266628",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5079,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5079"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 18,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5078 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5078 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5078
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=1c1f9 Call-ID: b15987afbc7549619d933651d0b071d3 CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.474398346266002,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5078,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "611e8d3206647a9625d70592482baad548fd0da6",
"event_fingerprint": "1ac95fa800165bce62f9e1200a9a701ab9246f59",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "8527517209a3c9521a4ed2e86192d1b5",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5078,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1c1f9\r\nCall-ID: b15987afbc7549619d933651d0b071d3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1c1f9\r\nCall-ID: b15987afbc7549619d933651d0b071d3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "793c4240f2531b5fd227e82bca4f89ffc0185aab",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5078,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK9a2ca8a1\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 17,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5075 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5075 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5075
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=ea639 Call-ID: caa3a94d4aa44eaf95e13bb9dd53c067 CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.472794200203781,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5075,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "93291295b227160835a9f78bb0f8351d45e1fe32",
"event_fingerprint": "3e64d544b8917f6e7ccea7bdccf9136c4fe77f7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "ed5ba666a7338e990b4c3771d2c59395",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5075,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ea639\r\nCall-ID: caa3a94d4aa44eaf95e13bb9dd53c067\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ea639\r\nCall-ID: caa3a94d4aa44eaf95e13bb9dd53c067\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b7893f898d2be608929eaf746b940c5f6c51a0b",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5075,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK13ea4984\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5075"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 16,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5074 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5074 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5074
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=a6e62 Call-ID: 53b64c5acf854a759eb829a39f11891c CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.474018327779296,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5074,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f1802749b3af9d8de7aa80026f502407679ad9ee",
"event_fingerprint": "96089a1cfe435612e66909c841f3815d082086bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "e37d206c36423c964655b25773d44ef8",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5074,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=a6e62\r\nCall-ID: 53b64c5acf854a759eb829a39f11891c\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=a6e62\r\nCall-ID: 53b64c5acf854a759eb829a39f11891c\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbf542b903f6e0da37a91f69f1bca15521e6d123",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5074,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bK5641f716\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5074"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5073 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5073 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5073
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=4c779 Call-ID: 2975a162cde84db0bafb487b99ae5c48 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.476087849291391,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5073,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4ffb4091b99ebb769e7bfd61bc52013b27ac5c99",
"event_fingerprint": "93d3904901ed14a8863a7f3a2f67028400f06750",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "68d91572d5e9a25c53302b7cbf4c7843",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5073,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4c779\r\nCall-ID: 2975a162cde84db0bafb487b99ae5c48\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4c779\r\nCall-ID: 2975a162cde84db0bafb487b99ae5c48\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1f4010bfaef02c073c687dd573920ec48bd88db",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5073,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bKa3f54d84\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5072 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5072 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5072
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=3833e Call-ID: 5c224b8783f8406a8b3a18f54680a97b CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.478587488495609,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5072,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "85aa1b0bc2eb9201f8936d0eb19709fcfb23b9b3",
"event_fingerprint": "bd48e15f882f1edcc690e6cb906daa92796ca567",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "1c6ba2c7ef5df75402a79b807c5211bb",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5072,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3833e\r\nCall-ID: 5c224b8783f8406a8b3a18f54680a97b\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3833e\r\nCall-ID: 5c224b8783f8406a8b3a18f54680a97b\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "131f719d73344f06af648edd94a30a986c1ba085",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5072,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK5abaf4c7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5072"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5071 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5071 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5071
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=f3031 Call-ID: b70a7e436a3a4eb0be7239930f417e7a CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.408641469701392,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5071,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "236c3ffe62fe57737c5d76a07e28b7ed340df38f",
"event_fingerprint": "5d0685defacb30a86e1f3b370655d74019cad2ce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "d6360989e46399666ba715ef5f2a0c50",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5071,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=f3031\r\nCall-ID: b70a7e436a3a4eb0be7239930f417e7a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=f3031\r\nCall-ID: b70a7e436a3a4eb0be7239930f417e7a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44c295781191f6253318718d031a7ff13daf6e62",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bKcf021e05\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5069 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5069 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5069
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=314b1 Call-ID: fbb47d2f3cf34c95bf3b57c49efffd78 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.506431165510695,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5069,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "11de6d03eb72631fbe41b7d6bfe2f97170e833de",
"event_fingerprint": "cc9be49bbdb168a7807a203ccfe4e70deb0f8c52",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "627a9dcffda43423c06f964010081474",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5069,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=314b1\r\nCall-ID: fbb47d2f3cf34c95bf3b57c49efffd78\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=314b1\r\nCall-ID: fbb47d2f3cf34c95bf3b57c49efffd78\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef2208473a5ba330b239f6291e1c91daf92b3c6b",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5069,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bKacc65b61\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5068 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5068 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5068
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=d7451 Call-ID: 23117d1478864d119fa2dedd2dd4a6e5 CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.497628207690402,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5068,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c106b573c520f908defb652bfc167601572455df",
"event_fingerprint": "951aed35c664e9755050097285242634ddc5291c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "ddfed34905dddafdb8c24197d4b8f3df",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5068,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=d7451\r\nCall-ID: 23117d1478864d119fa2dedd2dd4a6e5\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=d7451\r\nCall-ID: 23117d1478864d119fa2dedd2dd4a6e5\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2aad27c2a66d856accc114e89da5d6ac3a017580",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK5c21a310\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5067 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5067 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5067
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=d7e33 Call-ID: 8ff636c5ecec492ebc1e3c99f293430e CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.45550041681367,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b4ae4235d43e27aa913bf24c76fff82585ea21d8",
"event_fingerprint": "d0e49d5b45f2786f1d83de519fa549de821650fb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "07d5125fffda08614f4e60cf83255cc4",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5067,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=d7e33\r\nCall-ID: 8ff636c5ecec492ebc1e3c99f293430e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=d7e33\r\nCall-ID: 8ff636c5ecec492ebc1e3c99f293430e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "216657896138027773b9ba544489b6c200cabd0c",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bKcefeca8b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5066 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5066 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5066
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=00571 Call-ID: 427d7b40829e46999e462b09727de4a8 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.466362136905061,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "673091ace144c9cd261f81cee229edbccf22ffc5",
"event_fingerprint": "2532f199ab6fb310cb3f4a5cb1eec9dad2fe556e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "bd9ed72d992ba82287b1e910d73891e7",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5066,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=00571\r\nCall-ID: 427d7b40829e46999e462b09727de4a8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=00571\r\nCall-ID: 427d7b40829e46999e462b09727de4a8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59b72d4c131d0c319f90b56f3d04923eb9dd3748",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bKc9ffa626\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5065 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5065 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5065
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=99516 Call-ID: 1f82d8a67fde4a31b6e67142f47c2ba9 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.465868779035131,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5065,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a64af0ed402d937dfd6b61f111728ab725d02549",
"event_fingerprint": "bf8c51e199be33a3945600628fdb65301fb87323",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "65410e9400b5ed61521d7b51ed7930f5",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5065,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=99516\r\nCall-ID: 1f82d8a67fde4a31b6e67142f47c2ba9\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=99516\r\nCall-ID: 1f82d8a67fde4a31b6e67142f47c2ba9\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "372073557e968a34c7aa7aa4574f224d65f63794",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5065,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bK1e6eda1b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5064 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5064 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5064
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=76617 Call-ID: 938e90bffef24c97a74233b4d2c791dd CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.487433614256785,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "55dd9c28bb52b627f142f8f46a04723e3e54441a",
"event_fingerprint": "6ecd8dbdf4b610f20c772b55b95a9fb13107931a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "c6ef4d81811ce131e943d8584cd60c65",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5064,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=76617\r\nCall-ID: 938e90bffef24c97a74233b4d2c791dd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=76617\r\nCall-ID: 938e90bffef24c97a74233b4d2c791dd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8a3c5436e8b4e3605c2c3d4a941d4843f292b73",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK062618c3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5063 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5063 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5063
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=69314 Call-ID: 3fcf9385eb304780b6a58b2809e73bfc CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.50604962162498,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5063,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ef3014c2ae413cb99ea8d4323447d2a6bd4a6e0a",
"event_fingerprint": "2c44e9b548ab4b593e7b7423476000751c96f4d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "cd0f1fc272411bb1aea208d2fdb1da20",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5063,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69314\r\nCall-ID: 3fcf9385eb304780b6a58b2809e73bfc\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69314\r\nCall-ID: 3fcf9385eb304780b6a58b2809e73bfc\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e06e4b790f83f936934c35362963a5644a58a5d",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5063,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bK6a39be5d\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5063"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5070 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5070 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5070
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=6d869 Call-ID: c51924f1886047e2ae7a9a5ec99216c5 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.481264797566236,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5070,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "efebf4371d2a068359783b3d9e36e199e63b895b",
"event_fingerprint": "56c4448f115f78143fe87ec77e0301ce4dc21e2b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "94f33717ea6047749b2f6b36a3ed1131",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5070,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6d869\r\nCall-ID: c51924f1886047e2ae7a9a5ec99216c5\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6d869\r\nCall-ID: c51924f1886047e2ae7a9a5ec99216c5\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14b286a32b28a81097a42761d86705fd5c2d0bff",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5070,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK5d3eb1ba\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5060,
5061,
5062,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5062 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5062 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5062
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=6e59b Call-ID: c4ac4b88f02445529b1e1c9f57765549 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.466296237667753,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5062,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "888d6a8a205553db79660c345b8ae187b3998451",
"event_fingerprint": "e3273c3931eaa7afee757fae1577dede7fa2e7d3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "f5e719cdb9176c7a4d442756364ccb7b",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5062,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6e59b\r\nCall-ID: c4ac4b88f02445529b1e1c9f57765549\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6e59b\r\nCall-ID: c4ac4b88f02445529b1e1c9f57765549\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2358869a4dfe9f1ac1d7565e7fc6216b2a6a303f",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5062,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKfc3b8f34\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5062"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5061 · SIP TLS
|
sip-tls
|
Sonde SIP/VoIP
sip voip probe · via SIP TLS:5061 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP-TLS
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_tls_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5061
Chemin / cible
—
Service
SIP TLS
Payload
��~�ֻ�Ϊ����[�/��JE�\��p**p+fE� �\?�WEI���"��'��� �K ��#.r� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
75%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0578
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��~�ֻ�Ϊ����[�/��JE�\��p**p+fE� �\?�WEI���"��'��� �K ��#.r� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��~�ֻ�Ϊ����[�/��JE�\��p**p+fE� �\?�WEI���"��'��� �K ��#.r� $�,�0�+�/̨̩�$�(�#�' � � k g � � # * ( + - 3 & $ +wz�\��� ;�E%���*�l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 517,
"payload_entropy": 3.6710347252925755,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip-tls",
"app_proto": "sip-tls",
"asn": 23470,
"country": "HK",
"dst_port": 5061,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a",
"event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.75,
"classification_confidence": 0.75,
"precision_score": 75,
"precision_signals": [
"pat-0578",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0578",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "sip-tls",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df1fdd849871a7f27470c3c713a5b657",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5061,
"service": "sip-tls",
"service_name": "sip-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u05bb\ufffd\u0015\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\u0016\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\u001d\u0012\ufffdK\u001f\u0018\ufffd\u0010\ufffd#.r\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u05bb\ufffd\u0015\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\u0016\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\u001d\u0012\ufffdK\u001f\u0018\ufffd\u0010\ufffd#.r\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 +wz\ufffd\u0003\\\ufffd\ufffd\ufffd\t;\ufffdE%\ufffd\ufffd\ufffd*\ufffd\u0013l",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u05bb\ufffd\u0015\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\u0016\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\u001d\u0012\ufffdK\u001f\u0018\ufffd\u0010\ufffd#.r\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09edadedb6992782c32ee31115e514bebfc978dc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u05bb\ufffd\u0015\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\u0016\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\u001d\u0012\ufffdK\u001f\u0018\ufffd\u0010\ufffd#.r\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"evidence_snippet": "\ufffd\ufffd~\ufffd\u05bb\ufffd\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd#.r\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 75,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip-tls",
"service_label_fr": "SIP TLS",
"dst_port": 5061,
"protocol_emulated": true,
"tags_summary": [
"pat-0578",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0578",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u05bb\ufffd\u0015\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\u0016\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\u001d\u0012\ufffdK\u001f\u0018\ufffd\u0010\ufffd#.r\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd~\ufffd\u05bb\ufffd\u03aa\ufffd\ufffd\ufffd\ufffd[\ufffd\/\ufffd\ufffdJE\ufffd\\\ufffd\ufffdp**p+fE\ufffd \ufffd\\?\ufffdWEI\ufffd\ufffd\ufffd\"\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd#.r\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 75 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip_tls",
"service_banner": "honeypot-sip-tls",
"service_os": "linux",
"dst_port": "5061"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_tls_emulated",
"tls_clienthello"
]
}
|
|
|
TCP |
5060 · SIP
|
sip
|
Sonde SIP/VoIP
sip voip probe · via SIP:5060 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_emulated
sip_payload
sip_voip_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5060
Chemin / cible
—
Service
SIP
Payload
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e To: <sip:62.3.50.33> From: <sip:scanner
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
67%
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0535
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
HTTP OPTIONS method
SIP OPTIONS
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=0d202 Call-ID: 428a59be10264126a3d31cd3d2de3e21 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d",
"emulator_response_len": 215,
"bytes_in": 288,
"payload_entropy": 5.413214729167786,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip",
"app_proto": "sip",
"asn": 23470,
"country": "HK",
"dst_port": 5060,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9d47a028d45c994ea562e4af4fb360bfaa9c2d49",
"event_fingerprint": "3fcb8baeea4f587fed31373e40a068a2b2c72324",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 75,
"precision_signals": [
"pat-0535",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0535",
"INT-upstream"
],
"matched_patterns": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol",
"HTTP OPTIONS method",
"SIP OPTIONS"
],
"pattern_ids": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "sip",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f583bb48d6afd784a2aead41db58e17",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5060,
"service": "sip",
"service_name": "sip",
"risk_score": 45
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0d202\r\nCall-ID: 428a59be10264126a3d31cd3d2de3e21\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0d202\r\nCall-ID: 428a59be10264126a3d31cd3d2de3e21\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d484d9a07c84a49695e3a34a96f44d70814f275c",
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip",
"service_label_fr": "SIP",
"dst_port": 5060,
"protocol_emulated": true,
"tags_summary": [
"pat-0535",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0535",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bK02c5f75e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip",
"service_banner": "honeypot-sip",
"service_os": "linux",
"dst_port": "5060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_emulated",
"sip_payload",
"sip_voip_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5079 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5079 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5079
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=8985d Call-ID: 94c3b99a9dd4459d85b32920e29a160e CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.486058354074591,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5079,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ca0ec8f64d1dd1bdc1c9892c056d397ed3e1055a",
"event_fingerprint": "a7072d7f6ac57909738ed5f9032db030e6491c3c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "9704953717acac284bf1a9c5f6984ad1",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5079,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=8985d\r\nCall-ID: 94c3b99a9dd4459d85b32920e29a160e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=8985d\r\nCall-ID: 94c3b99a9dd4459d85b32920e29a160e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc37304533ae571424ccb85f10bef4b773d25811",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5079,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5079"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 18,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5078 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5078 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5078
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=79cda Call-ID: c28a506c399a47bc972a1bc202af320e CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.442208221775633,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5078,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "611e8d3206647a9625d70592482baad548fd0da6",
"event_fingerprint": "1ac95fa800165bce62f9e1200a9a701ab9246f59",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "9a980973c5f05da482aa085b7270c2f5",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5078,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=79cda\r\nCall-ID: c28a506c399a47bc972a1bc202af320e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=79cda\r\nCall-ID: c28a506c399a47bc972a1bc202af320e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc15d34aa711eede9ab77dc1c5ba6445d569b8e1",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5078,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 17,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5075 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5075 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5075
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=3491f Call-ID: 5a0df086160d4c5084aec2260ba54598 CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.453870090692852,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5075,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "93291295b227160835a9f78bb0f8351d45e1fe32",
"event_fingerprint": "3e64d544b8917f6e7ccea7bdccf9136c4fe77f7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "d2e0e8729ec1d1637bc7b4069f4e4b4d",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5075,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3491f\r\nCall-ID: 5a0df086160d4c5084aec2260ba54598\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3491f\r\nCall-ID: 5a0df086160d4c5084aec2260ba54598\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81afd3eed8a9bf8854494759d7587e5176a0940f",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5075,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5075"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 16,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5074 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5074 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5074
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=69b1c Call-ID: 8be670aaf7b4454ab1b142aa05d5d226 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.477368410616853,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5074,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f1802749b3af9d8de7aa80026f502407679ad9ee",
"event_fingerprint": "96089a1cfe435612e66909c841f3815d082086bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "7f16abd31d6286897ecfbb5353736e2b",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5074,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69b1c\r\nCall-ID: 8be670aaf7b4454ab1b142aa05d5d226\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69b1c\r\nCall-ID: 8be670aaf7b4454ab1b142aa05d5d226\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "049a5bcfdd194ca8479ed20fa0d9fb9e3fbbce77",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5074,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5074"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5073 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5073 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5073
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=b5c40 Call-ID: c0b966f8336b422b8db2ef1d5f8d618e CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.489443358752779,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5073,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4ffb4091b99ebb769e7bfd61bc52013b27ac5c99",
"event_fingerprint": "93d3904901ed14a8863a7f3a2f67028400f06750",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "6b975e86cbac14215356ce7a340f20e8",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5073,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b5c40\r\nCall-ID: c0b966f8336b422b8db2ef1d5f8d618e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b5c40\r\nCall-ID: c0b966f8336b422b8db2ef1d5f8d618e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1676972e6192be5f2a97c33a05994a684f82633c",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5073,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5072 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5072 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5072
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=4fc27 Call-ID: 91e7677fbdc4413784d3ebd48ca0933a CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.458804147802893,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5072,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "85aa1b0bc2eb9201f8936d0eb19709fcfb23b9b3",
"event_fingerprint": "bd48e15f882f1edcc690e6cb906daa92796ca567",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "462fa2d40f0d2a87fa0da7cb19037590",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5072,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4fc27\r\nCall-ID: 91e7677fbdc4413784d3ebd48ca0933a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4fc27\r\nCall-ID: 91e7677fbdc4413784d3ebd48ca0933a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e6cc9ea41030f99311bebe6da6ea7cc331181da",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5072,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5072"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5071 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5071 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5071
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=cf433 Call-ID: e5797e91a3604003ae08d121c9ceb1db CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.448740693973408,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5071,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "236c3ffe62fe57737c5d76a07e28b7ed340df38f",
"event_fingerprint": "5d0685defacb30a86e1f3b370655d74019cad2ce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "4c580991787170735062b2d7d2b8e64f",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5071,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=cf433\r\nCall-ID: e5797e91a3604003ae08d121c9ceb1db\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=cf433\r\nCall-ID: e5797e91a3604003ae08d121c9ceb1db\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5e7aa3cda0f4ce37943f4e7ab9e7adf78e6c849",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5069 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5069 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5069
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=0f6b7 Call-ID: 57ad82cf39cd41bea5b3a462c9184c9e CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.514761451442929,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5069,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "11de6d03eb72631fbe41b7d6bfe2f97170e833de",
"event_fingerprint": "cc9be49bbdb168a7807a203ccfe4e70deb0f8c52",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "c9d5ecda80accc340e21293fec562ca4",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5069,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0f6b7\r\nCall-ID: 57ad82cf39cd41bea5b3a462c9184c9e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0f6b7\r\nCall-ID: 57ad82cf39cd41bea5b3a462c9184c9e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37965741f5a8d8f6775e01e37ee8d55de5c64d00",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5069,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5068 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5068 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5068
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=aff47 Call-ID: ccf5e1c5d8d843909b535927b7860090 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.470384560476459,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5068,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c106b573c520f908defb652bfc167601572455df",
"event_fingerprint": "951aed35c664e9755050097285242634ddc5291c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "d64b0be84bdc9f4f205fcdf67201f661",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5068,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=aff47\r\nCall-ID: ccf5e1c5d8d843909b535927b7860090\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=aff47\r\nCall-ID: ccf5e1c5d8d843909b535927b7860090\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da0c70a1fd8e5b021c110a4831374724f50d4a7f",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5067 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5067 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5067
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=dbf33 Call-ID: 60af49b0a91645f994e753de8560e129 CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.470649910951099,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b4ae4235d43e27aa913bf24c76fff82585ea21d8",
"event_fingerprint": "d0e49d5b45f2786f1d83de519fa549de821650fb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "07fa92784d9f6cc3e93e34fd702f74fe",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5067,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=dbf33\r\nCall-ID: 60af49b0a91645f994e753de8560e129\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=dbf33\r\nCall-ID: 60af49b0a91645f994e753de8560e129\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfb7bd25625cff265cbd889df6119cdea16688a0",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5066 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5066 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5066
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=73833 Call-ID: 23534ef0884f433c858945f21f2254e3 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.438664524357506,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "673091ace144c9cd261f81cee229edbccf22ffc5",
"event_fingerprint": "2532f199ab6fb310cb3f4a5cb1eec9dad2fe556e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "f8c06e84e3b126b4579f9c8aa9f939ab",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5066,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=73833\r\nCall-ID: 23534ef0884f433c858945f21f2254e3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=73833\r\nCall-ID: 23534ef0884f433c858945f21f2254e3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5958f6eb241cdb4356ea9a9d53c168d304a1e8c",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5065 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5065 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5065
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=b13d8 Call-ID: 64a09ca903874853af896f264742adcd CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.526340430715244,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5065,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a64af0ed402d937dfd6b61f111728ab725d02549",
"event_fingerprint": "bf8c51e199be33a3945600628fdb65301fb87323",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "ef0e2806abdefc2065f4312962300887",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5065,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b13d8\r\nCall-ID: 64a09ca903874853af896f264742adcd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b13d8\r\nCall-ID: 64a09ca903874853af896f264742adcd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91f2b093f86aacecc87eea486798e4327bdb5ec8",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5065,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5064 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5064 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5064
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=1b4b6 Call-ID: 42be386eedf54372abc322e1e5b38fd2 CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.4883211101360265,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "55dd9c28bb52b627f142f8f46a04723e3e54441a",
"event_fingerprint": "6ecd8dbdf4b610f20c772b55b95a9fb13107931a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "d20f08f9159c98b53ab1f169c174730c",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5064,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1b4b6\r\nCall-ID: 42be386eedf54372abc322e1e5b38fd2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1b4b6\r\nCall-ID: 42be386eedf54372abc322e1e5b38fd2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eac216523e90896f7cc93a707bf5c1665c765eef",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5063 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5063 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5063
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=69c11 Call-ID: 36a2de70f28d4ca199f0c851a56f521e CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.481776099242981,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5063,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ef3014c2ae413cb99ea8d4323447d2a6bd4a6e0a",
"event_fingerprint": "2c44e9b548ab4b593e7b7423476000751c96f4d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "1c9a6d42fa9e00ea74947b8c1c806a13",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5063,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69c11\r\nCall-ID: 36a2de70f28d4ca199f0c851a56f521e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69c11\r\nCall-ID: 36a2de70f28d4ca199f0c851a56f521e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55a8d6bba0902e5eb25bffbd27ebffcb5fa04872",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5063,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5063"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5070 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5070 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5070
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=ba81f Call-ID: 5d7671d353be41e7b6f41ec9c073e77d CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.473394939884921,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5070,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "efebf4371d2a068359783b3d9e36e199e63b895b",
"event_fingerprint": "56c4448f115f78143fe87ec77e0301ce4dc21e2b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "0617bf30d276c7e74d96bde37181ed81",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5070,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ba81f\r\nCall-ID: 5d7671d353be41e7b6f41ec9c073e77d\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ba81f\r\nCall-ID: 5d7671d353be41e7b6f41ec9c073e77d\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92b79cb163eb21e69602bd393e2a745bab510d91",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5070,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5060,
5061,
5062,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5062 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5062 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5062
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=698fd Call-ID: 8ee0e839faa9480bab9616185d8ef8ac CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.479717040875289,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5062,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "888d6a8a205553db79660c345b8ae187b3998451",
"event_fingerprint": "e3273c3931eaa7afee757fae1577dede7fa2e7d3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "bbe8dfd3d5f1cabeec060c277cce7d4b",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5062,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=698fd\r\nCall-ID: 8ee0e839faa9480bab9616185d8ef8ac\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=698fd\r\nCall-ID: 8ee0e839faa9480bab9616185d8ef8ac\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0786d446d739f42ff180f733bedb1f31eb279e35",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5062,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5062"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5061 · SIP TLS
|
sip-tls
|
Sonde SIP/VoIP
sip voip probe · via SIP TLS:5061 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP-TLS
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_tls_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5061
Chemin / cible
—
Service
SIP TLS
Payload
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
75%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0578
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � � # * ( + - 3 & $ �+ݚ�e���G�,c8J�%%
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 517,
"payload_entropy": 3.697171475486419,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip-tls",
"app_proto": "sip-tls",
"asn": 23470,
"country": "HK",
"dst_port": 5061,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a",
"event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.75,
"classification_confidence": 0.75,
"precision_score": 75,
"precision_signals": [
"pat-0578",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0578",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "sip-tls",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e76cb27c705ce4f9df7639b4d6a46451",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5061,
"service": "sip-tls",
"service_name": "sip-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd+\u075a\ufffde\ufffd\ufffd\u0015\ufffdG\ufffd,c8J\ufffd%\u000f%",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31ca858793458d964637e4f4470088af51e210b8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"evidence_snippet": "\ufffd}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} ,\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\u0286\ufffdT(\ufffd\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 75,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip-tls",
"service_label_fr": "SIP TLS",
"dst_port": 5061,
"protocol_emulated": true,
"tags_summary": [
"pat-0578",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0578",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} ,\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\u0286\ufffdT(\ufffd\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 75 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip_tls",
"service_banner": "honeypot-sip-tls",
"service_os": "linux",
"dst_port": "5061"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_tls_emulated",
"tls_clienthello"
]
}
|
|
|
TCP |
5060 · SIP
|
sip
|
Sonde SIP/VoIP
sip voip probe · via SIP:5060 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_emulated
sip_payload
sip_voip_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5060
Chemin / cible
—
Service
SIP
Payload
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e To: <sip:62.3.50.33> From: <sip:scanner
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
67%
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0535
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
HTTP OPTIONS method
SIP OPTIONS
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=6705f Call-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d",
"emulator_response_len": 215,
"bytes_in": 288,
"payload_entropy": 5.4817517324103715,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip",
"app_proto": "sip",
"asn": 23470,
"country": "HK",
"dst_port": 5060,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9d47a028d45c994ea562e4af4fb360bfaa9c2d49",
"event_fingerprint": "3fcb8baeea4f587fed31373e40a068a2b2c72324",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 75,
"precision_signals": [
"pat-0535",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0535",
"INT-upstream"
],
"matched_patterns": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol",
"HTTP OPTIONS method",
"SIP OPTIONS"
],
"pattern_ids": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "sip",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5d1a54ced56024cae6ffa753faeb5b17",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5060,
"service": "sip",
"service_name": "sip",
"risk_score": 45
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6705f\r\nCall-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6705f\r\nCall-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6625cb372fad33906e5c6f14860a79f4ced44e39",
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip",
"service_label_fr": "SIP",
"dst_port": 5060,
"protocol_emulated": true,
"tags_summary": [
"pat-0535",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0535",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip",
"service_banner": "honeypot-sip",
"service_os": "linux",
"dst_port": "5060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_emulated",
"sip_payload",
"sip_voip_probe"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.052177340805246,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2e886b117aa3c712c81c8e9777ac06bd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7f921afb5ee93d75d88fb71ecc92e34644fc5de",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdNO\ufffd\ufffd\ufffd8x\u05fd\ufffd\ufffd=fx\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdNO\ufffd\ufffd\ufffd8x\u05fd\ufffd\ufffd=fx\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.35,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.088229971319601,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "f6661a26d432a76d3ee381382fa06dba",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6d818ce9562065288167f00e54a27f815c2f248",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffdRm\ufffdT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffdRm\ufffdT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.33,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.06558700256614,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "322444b42c185e2e6372da7b1d17e033",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16b68a4f60b6d99eb12f842f93a72585f134f45c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdb\ufffd\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdK\ufffd\t\ufffd\ufffd\ufffd%`\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdb\ufffd\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdK\ufffd\t\ufffd\ufffd\ufffd%`\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.031408601454584,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "eea3fd4d8980d8a43b38ba13c760f4ab",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efdcbd878e898ed9bac1364a6386caedd5fa849c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdE+\ufffd\ufffd\ufffd\\\ufffd\u0620\ufffdV\ufffdC\/\ufffd*\ufffd%r\ufffdUR\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdE+\ufffd\ufffd\ufffd\\\ufffd\u0620\ufffdV\ufffdC\/\ufffd*\ufffd%r\ufffdUR\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.28,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�֯�uƒ��&]w�Ç/5� v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�֯�uƒ��&]w�Ç/5�
v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�֯�uƒ��&]w�Ç/5� v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.098377657519625,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "99b05dbbc29f0ed8ed39ba17575b30f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de2c62436a162701c2f0b2cbad1bd308b4cd0f11",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\u05af\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\u05af\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.076484091046866,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "9d282c9dd44fac94a14adb7d03248ff0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ef0714447c9981df585c82800de731c6ba59ad6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\u06e9\ufffd\ufffd\ufffdwx#!\ufffd\ufffd\ufffdU\ufffd\ufffd?R\ufffd``\ufffd\ufffd\ufffd\ufffdvp \ufffd\ufffdOWkA\ufffdSm\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdSI\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\u06e9\ufffd\ufffd\ufffdwx#!\ufffd\ufffd\ufffdU\ufffd\ufffd?R\ufffd``\ufffd\ufffd\ufffd\ufffdvp \ufffd\ufffdOWkA\ufffdSm\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdSI\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
��(���h��dބ�gęY��e< �� (���V Q8 ���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��(���h��dބ�gęY��e<
�� (���V Q8
���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��(���h��dބ�gęY��e< �� (���V Q8 ���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.028315333353045,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c64814589d87c8ff304097ba928c12a0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96ad96b798c56d32a5511123b2caa7ec7d75c669",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd(\ufffd\ufffd\ufffdV Q8\n\ufffd\ufffd\ufffdm\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffdvj\u05eb\ufffd\ufffd}\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd(\ufffd\ufffd\ufffdV Q8\n\ufffd\ufffd\ufffdm\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffdvj\u05eb\ufffd\ufffd}\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w� ����;�B�^ ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w�
����;�B�^
��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w� ����;�B�^ ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.05871340528831,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "dc62925bf7a6d7527f0009a1bb52ae33",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191666c7cd7cce75d2f1ef59ad17dbc4ff766467",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdy'\ufffd\ufffd\ufffd\ufffdjX@\ufffd\u0137\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdy'\ufffd\ufffd\ufffd\ufffdjX@\ufffd\u0137\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.19,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 4.995980348816743,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2bd229b2a009de6d0e816d70c9cf4660",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62bb8bcab2d711767239471246f8cf8d6a4af4f0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffdm\ufffd h4c\ufffd\ufffd|\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffdm\ufffd h4c\ufffd\ufffd|\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.09,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.066833067386438,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "dd49e85da3aa639a4972f778eb1c4545",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "409badc242a265c1e196d2786bea146ffb2da24e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffdZ \ufffd|\ufffd5\ufffd%\ufffd\ufffdk\ufffd\ufffdqj,>\ufffdQ#\ufffd\ufffd\ufffd-\ufffd|\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffdZ \ufffd|\ufffd5\ufffd%\ufffd\ufffdk\ufffd\ufffdqj,>\ufffdQ#\ufffd\ufffd\ufffd-\ufffd|\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.97,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
� 3�\Y�3[`� ��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� 3�\Y�3[`�
��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
� 3�\Y�3[`� ��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.064241162472857,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2c890461330c8c6b0ad05ffefcfd865e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8f3b641cd01fda68cef307efb6fae51910ed2a3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\ufffd(G\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\ufffd(G\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.92,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.034355542016214,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "76738e86b9b819f914a184ae5ae8f267",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5421579c290892665b944c0d9b6a2889d7e4b630",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{yN\u059d\ufffd\ufffd-\ufffdcT\ufffdL\ufffdz$rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{yN\u059d\ufffd\ufffd-\ufffdcT\ufffdL\ufffdz$rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.89,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��I�< 6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I ��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��I�<
6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I
��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��I�< 6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I ��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.069243637945447,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "6b2342ccef28f11dddfc7b3df98b29e6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f1f0ea095b736a46a725084d98e2c14ba3b55e0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdI\ufffd<\r6\ufffd\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd,\ufffdX !\ufffdk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\ufffd\ufffdp\ufffd\u0391\\<UG\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdI\ufffd<\r6\ufffd\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd,\ufffdX !\ufffdk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\ufffd\ufffdp\ufffd\u0391\\<UG\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.87,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N� Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N�
Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N� Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.072163227632063,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c83e851d502f21fe3019b955219fb3c2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36064ebbfdab87346f04437496968c547479ab86",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{78\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"q3\tB\ufffdoA\ufffd+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{78\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"q3\tB\ufffdoA\ufffd+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|