Renseignement sur les menaces

R.A.S. chinoise de Hong Kong

185.243.5.8

FAI ReliableSite.Net LLC Première vue 25/07/2026 18:28 UTC Dernière vue 27/07/2026 20:53 UTC Risque Moyen

Période analysée : 2026-06-27 → 2026-07-27

Activité suspecte — risque 60/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 60/100 Moyen

Première observation 25/07/2026 18:28 UTC

Dernière observation 27/07/2026 20:53 UTC

Événements (période) 331

MITRE ATT&CK principal T1046 297 occurrences

Activité suspecte — risque 60/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 100 · Bonus corrélation +14 · 5 tag(s) WAF

Comparaison ASN / FAI

ASN 23470 · 185.243.5.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 331 événements sur la période pour cette IP.

185.243.5.47 Traversal LFI 27/07/2026 20:10 UTC
185.243.5.56 Sonde SIP/VoIP 27/07/2026 09:43 UTC
185.243.5.73 Sonde port 27/07/2026 02:31 UTC
104.243.43.145 Sonde SSH 26/07/2026 20:46 UTC
172.110.223.96 Sonde port 1723/TCP 26/07/2026 10:52 UTC
172.110.223.224 Sonde TLS 24/07/2026 04:36 UTC
172.110.223.121 Sonde TLS 24/07/2026 04:17 UTC
185.243.5.110 Sonde SIP/VoIP 22/07/2026 23:31 UTC

Événements (filtres)

331

Première observation

25/07/2026 18:28 UTC

Dernière observation

27/07/2026 20:53 UTC

Dernière activité (filtres)

27/07/2026 20:53 UTC

Événements 7j

331

Ports distincts (7j)

106

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 256 HTTP TCP 32 SIP TLS TCP 24 SIP TCP 3 X11 3 TCP 1 KAFKA SSL TCP 1 UPNP TCP TCP 1 MINIO CONSOLE TCP 1 WEBLOGIC TCP 1 NOMAD HTTP TCP 1 GRAFANA TCP 1 WEBLOGIC SSL TCP 1 ORACLE EM TCP 1 X11 TCP 1 TOR OR TCP 1 PERSONAL AGENT TCP 1 HTTP ALT 8001 TCP 1 X11 2 TCP 1 UPNP SSL TCP 1 REMOTEANYTHING TCP 1

TLS

256

HTTP

SIP TLS

SIP

X11 3

KAFKA SSL

Géolocalisation

Origine réseau déclarée

R.A.S. chinoise de Hong Kong unknown unknown

FAI / réseau

Opérateur et dernière activité ban

ReliableSite.Net LLC 0 Port 5060 sip_voip_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:5079 · (reconnaissance) · → sip:62.3.50.33

Détails protocole

Méthode: OPTIONS
Chemin: sip:62.3.50.33
User-Agent: Avaya One-X Deskphone

Aperçu payload

OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819 To: <sip:62.3.50.33> From: <sip:scanner

Port / service

5079 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 5 tag(s) WAF

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +14

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

331 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

331 événement(s) — page 2/7

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��v�+�܀3_�(T�J��r�Yz�m��\|t � ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\\|��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��v�+�܀3_�(T�J��r�Yz�m��\|t � ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\\|��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��v�+�܀3_�(T�J��r�Yz�m��\|t � ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\\|��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.046014880819623, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "b05e63c3d708396d53d877ddb6a66281", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d4dc314072766f626c8a63d92c7847d8ed893349", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdv\ufffd+\ufffd\u07003_\ufffd(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdv\ufffd+\ufffd\u07003_\ufffd(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\ufffd\|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\\|\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.83, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��m^u:�0�j(�u�G�7�߀BK�( ��h ��Q�3�-N��d��cԥ� �0��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��m^u:�0�j(�u�G�7�߀BK�(��h ��Q�3�-N��d��cԥ��0��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��m^u:�0�j(�u�G�7�߀BK�( ��h ��Q�3�-N��d��cԥ� �0��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.064190864404135, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "59bfe51a1d8b166d14e5d18cb9ba19be", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e18784a201beea6bd52d91083fabc91044d2ad97", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdm^u:\ufffd0\ufffdj(\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\ufffdQ\ufffd3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdc\u0525\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdm^u:\ufffd0\ufffdj(\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\ufffdQ\ufffd3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdc\u0525\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.38, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload �P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d�h�sz 3f�z H�e��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d�h�sz 3f�z H�e��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d�h�sz 3f�z H�e��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.06178662263089, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "5f568415140aaa8ee6c7f99a14f1a2ec", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dd45311bd56270213780255e935a323846c10236", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdP\ufffdc\u044aq\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\ufffd:\ufffd\ufffda\ufffd \ufffdB\ufffd \ufffd\\\ufffd\ufffduX\ufffdd\ufffdh\ufffdsz\r3f\ufffdz H\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdP\ufffdc\u044aq\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\ufffd:\ufffd\ufffda\ufffd \ufffdB\ufffd \ufffd\\\ufffd\ufffduX\ufffdd\ufffdh\ufffdsz\r3f\ufffdz H\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.37, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��² �}ɠ8��ݦ�{M��,42�3�y р�v�)ғ^��_� HJ=�！�#kH��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��²�}ɠ8��ݦ�{M��,42�3�y р�v�)ғ^��_� HJ=�！�#kH��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��² �}ɠ8��ݦ�{M��,42�3�y р�v�)ғ^��_� HJ=�！�#kH��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.075729043608639, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "c40f426e10b5f7ae57ddfae82d8ee31a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "043da3b281354fe732ff29a42d1bd4e48996d373", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd}\u02608\ufffd\ufffd\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy \u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd}\u02608\ufffd\ufffd\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy \u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.35, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload �H��Yh�p��,��K5�}X� ��-�� g 8�.D�Q��D��ؠlPʢ�5BW�fK��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �H��Yh�p��,��K5�}X� ��-�� g 8�.D�Q��D��ؠlPʢ�5BW�fK��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �H��Yh�p��,��K5�}X� ��-�� g 8�.D�Q��D��ؠlPʢ�5BW�fK��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.010485841734837, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "fc1415f4f6be2c29e1906689e9023cee", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b1f38a7722d009e7eed7d8988c93289b1c99dd2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdH\ufffd\ufffd\ufffd\ufffdYh\ufffdp\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n8\ufffd.D\ufffdQ\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffdfK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdH\ufffd\ufffd\ufffd\ufffdYh\ufffdp\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n8\ufffd.D\ufffdQ\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffdfK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.34, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��Ie��8��w)��6�L��n5,�� &�� d��NlR�j�]��j��Nx��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ie��8��w)��6�L��n5,�� &��d��NlR�j�]��j��Nx��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��Ie��8��w)��6�L��n5,�� &�� d��NlR�j�]��j��Nx��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.055739571267462, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "85add381dab11faa89c1d5a32ed9edaa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "23bbe5eb5f93b39819c0527df1c3751383b717ac", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdNx\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdNx\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.32, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��)v��y]N�$y#��S �%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��)v��y]N�$y#��S �%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��)v��y]N�$y#��S �%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0322680057472535, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "45c46af90271192efacadb0548da1408", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b0c3d3b1ab17e0cc36aa5a4da114329876f1771", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd)v\ufffd\ufffdy]N\ufffd$y#\ufffd\ufffdS\n\ufffd%\ufffdAO\"\ufffd\"GB\"\ufffd \ufffdI\ufffdo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd)v\ufffd\ufffdy]N\ufffd$y#\ufffd\ufffdS\n\ufffd%\ufffdAO\"\ufffd\"GB\"\ufffd \ufffdI\ufffdo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.31, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��4�W�e��;��2��K� ��'� �X v��C�/ޥ0 ��2�ͽx��h�, ��nj:t��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��4�W�e��;��2��K��'� �X v��C�/ޥ0 ��2�ͽx��h�, ��nj:t��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��4�W�e��;��2��K� ��'� �X v��C�/ޥ0 ��2�ͽx��h�, ��nj:t��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.036717495014359, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "d88eff9ed010e4dc7ad071a2fe9d71d7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e05638c4c45f48cbf34e2c39521edd2ca52c91cc", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd4\ufffdW\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\ufffd\ufffdK\ufffd\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a50\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd4\ufffdW\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\ufffd\ufffdK\ufffd\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a50\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.3, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:34 UTC	TCP	5067 · TLS	tls	Scan de ports port scan syn · via TLS:5067 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5067 Chemin / cible — Service TLS Payload ��m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby $�͗���4��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby$�͗���4��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby $�͗���4��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 4.977687014859778, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5067, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11", "event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "94de5ae1e6941ae40d3fca11dfba44a4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5067, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a2e99e130cf8afecaf9099917594c3bf94c15215", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\%F \ufffdhg\ufffd_\ufffd \ufffds\ufffdk(t]\ufffd+\t\ufffdV\ufffd\ufffdWby$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5067, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5067, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\%F \ufffdhg\ufffd_\ufffd \ufffds\ufffdk(t]\ufffd+\t\ufffdV\ufffd\ufffdWby$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5067 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5067" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 4.29, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �u��by��+��t� :s��p��4D� ��߼�8�ع4��J��CMeY��2��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �u��by��+��t�:s��p��4D� ��߼�8�ع4��J��CMeY��2��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �u��by��+��t� :s��p��4D� ��߼�8�ع4��J��CMeY��2��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.090200783201618, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "4830da7eb6159505af668b4fea15dd3e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47e3c3fe1e06aef9a9d38177f57704e0af07f5a5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdby\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd:s\ufffd\ufffdp\ufffd\ufffd4D\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdby\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd:s\ufffd\ufffdp\ufffd\ufffd4D\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.98, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �PA뗠��} �M(J�~CD�i {F��r� x�-퍷D�X��^1�u�� \��뼷��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �PA뗠��} �M(J�~CD�i{F��r� x�-퍷D�X��^1�u�� \��뼷��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �PA뗠��} �M(J�~CD�i {F��r� x�-퍷D�X��^1�u�� \��뼷��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.024386147760822, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "8611f9de11896f9bf37686fe91c340cc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07ab697c9763da86d37975d77ca1d89b8e07db5f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdPA\ub5e0\ufffd\ufffd\ufffd}\n\ufffdM(J\ufffd~CD\ufffdi{F\ufffd\ufffdr\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd^1\ufffdu\ufffd\ufffd\ufffd \\\ufffd\ufffd\ubf37\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdPA\ub5e0\ufffd\ufffd\ufffd}\n\ufffdM(J\ufffd~CD\ufffdi{F\ufffd\ufffdr\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd^1\ufffdu\ufffd\ufffd\ufffd \\\ufffd\ufffd\ubf37\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.93, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload ��B��z��l�H��.�F4�z�\�� h!�/s�G� ��t��X ��V�n?��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��B��z��l�H��.�F4�z�\�� h!�/s�G� ��t��X ��V�n?��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��B��z��l�H��.�F4�z�\�� h!�/s�G� ��t��X ��V�n?��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.017046845489416, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "c1ff3cd7921e10a559ec668b8e6bc430", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "be6060a137a298de7fdef6837eb5d62e28a5d5d6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffd\ufffdl\ufffdH\ufffd\ufffd.\ufffdF4\ufffdz\ufffd\\\ufffd\ufffd h!\ufffd\/s\ufffdG\ufffd\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdX\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffd\ufffdl\ufffdH\ufffd\ufffd.\ufffdF4\ufffdz\ufffd\\\ufffd\ufffd h!\ufffd\/s\ufffdG\ufffd\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdX\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.85, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �a7��Ǹ��d.��k�fr��9�� ͅ�.��>U��@�/;\݅��&�\��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �a7��Ǹ��d.��k�fr��9�� ͅ�.��>U��@�/;\݅��&�\��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �a7��Ǹ��d.��k�fr��9�� ͅ�.��>U��@�/;\݅��&�\��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.052186075357377, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "7530e474e47c757c20198d72e4478697", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b25fdd1775fc02b2bc695f3618b4bf0cb18072b6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffda7\ufffd\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\/;\\\u0745\ufffd\ufffd\ufffd\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffda7\ufffd\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\/;\\\u0745\ufffd\ufffd\ufffd\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.79, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload ��c+�6`��m:��x� ��fk�!�c� �w�=��Z�G��%��&�#�>+Ɓ��m��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��c+�6`��m:��x� ��fk�!�c� �w�=��Z�G��%��&�#�>+Ɓ��m��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��c+�6`��m:��x� ��fk�!�c� �w�=��Z�G��%��&�#�>+Ɓ��m��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.064124892089081, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "5a0c29799e4789515e4417270d811103", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1aa340c004ea71d70c7d07f372345af20e9d57ec", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdc+\ufffd6`\ufffd\ufffdm:\ufffd\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd \ufffdw\ufffd=\ufffd\ufffdZ\ufffdG\ufffd\ufffd%\ufffd\ufffd&\ufffd#\ufffd>+\u0181\ufffd\ufffdm\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdc+\ufffd6`\ufffd\ufffdm:\ufffd\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd \ufffdw\ufffd=\ufffd*\ufffdZ\ufffdG\ufffd\ufffd%\ufffd\ufffd&\ufffd#\ufffd>+\u0181\ufffd\ufffdm\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.67, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload ��[��!̴��hH�]M^O��^ �@D�%S��V<�]\c�C��`(�.��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��[��!̴��hH�]M^O��^ �@D�%S��V<�]\c�C��`(�.��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��[��!̴��hH�]M^O��^ �@D�%S��V<�]\c�C��`(�.��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.047071948955126, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "522f1c43f28a7920d3c3b1a3e092233e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa813050c76af0ec5db7647b14bc10b8add99f2f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^ \ufffd@D\ufffd%S\ufffd\ufffd\ufffd\ufffd\ufffdV<\ufffd]\\c\ufffdC\ufffd\ufffd`(\ufffd.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^ \ufffd@D\ufffd%S\ufffd\ufffd\ufffd\ufffd\ufffdV<\ufffd]\\c\ufffdC\ufffd\ufffd`(\ufffd.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.61, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �� g4;5joR�;��Η��T�D� ��t��p$P PL��c֋��KoJ��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �� g4;5joR�;��Η��T�D� ��t��p$P PL��c֋��KoJ��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �� g4;5joR�;��Η��T�D� ��t��p$P PL��c֋��KoJ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.050463162230656, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "c9fccc20a5eca0f03cb28d9f81d69cfd", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "54ba21456bbd55b0c57fcf36cb5ab54244ee7cea", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rg4;5joR\ufffd;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\ufffdp$P\nPL\ufffd\ufffd\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rg4;5joR\ufffd;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\ufffdp$P\nPL\ufffd\ufffd\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.56, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �ᐻ�ˬ��Bha��I�R��o�u�L��`$� �q�� j��\5T��Uz��g_(�9gbO�%B��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �ᐻ�ˬ��Bha��I�R��o�u�L��`$� �q��j��\5T��Uz��g_(�9gbO�%B��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �ᐻ�ˬ��Bha��I�R��o�u�L��`$� �q�� j��\5T��Uz��g_(�9gbO�%B��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.060019371966197, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "855e77a297e47ca20d8026a770114278", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "53848fd75d9d4f4ad5db3b05c60b86d9fea3d410", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\u143b\ufffd\u02ec\ufffd\ufffd\ufffdBha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\ufffd\ufffdj\ufffd\ufffd\\5T\ufffd\ufffdUz\ufffd\ufffdg_(\ufffd9gbO\ufffd%B\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\u143b\ufffd\u02ec\ufffd\ufffd\ufffdBha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\ufffd\ufffdj\ufffd\ufffd\\5T\ufffd\ufffdUz\ufffd\ufffdg_(\ufffd9gbO\ufffd%B\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.51, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5066 · TLS	tls	Scan de ports port scan syn · via TLS:5066 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload �Rmw� ��8��U�]��C )s�g1hA�� U$J$F�ǚ��O��y��F�}�bN��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �Rmw��8��U�]��C )s�g1hA�� U$J$F�ǚ��O��y��F�}�bN��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �Rmw� ��8��U�]��C )s�g1hA�� U$J$F�ǚ��O��y��F�}�bN��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0396483427002154, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d", "event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "4b3f5f1d0b95079f80ce8aada91a58ad", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2248ef5adddb0a0dec8af90b7f69009505ce1e7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdRmw\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffdg1hA\ufffd\ufffd \ufffd\ufffdU$J$F\ufffd\u01da\ufffd\ufffd\ufffdO\ufffd\ufffdy\ufffd\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdRmw\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffdg1hA\ufffd\ufffd \ufffd\ufffdU$J$F\ufffd\u01da\ufffd\ufffd\ufffdO\ufffd\ufffdy\ufffd\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.46, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �.V�L�4;��˙�-��p��h>�Ђ4u/Mte �h��]]�ġ�h�u��>��ٜ�!��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �.V�L�4;��˙�-��p��h>�Ђ4u/Mte �h��]]�ġ�h�u��>��ٜ�!��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �.V�L�4;��˙�-��p��h>�Ђ4u/Mte �h��]]�ġ�h�u��>��ٜ�!��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.034434761052709, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e7a9731b88743f0ad91f8c77cb7b539d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd\u0007-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024\u001cu\/Mte \ufffd\u0000h\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\u0004\ufffd\u0017\ufffd\ufffd>\u0018\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd\u0007-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024\u001cu\/Mte \ufffd\u0000h\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\u0004\ufffd\u0017\ufffd\ufffd>\u0018\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd\u0007-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024\u001cu\/Mte \ufffd\u0000h\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\u0004\ufffd\u0017\ufffd\ufffd>\u0018\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3db4086aee614396ad787653299e8c421f5b8827", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd\u0007-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024\u001cu\/Mte \ufffd\u0000h\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\u0004\ufffd\u0017\ufffd\ufffd>\u0018\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024u\/Mte \ufffdh\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd\u0007-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024\u001cu\/Mte \ufffd\u0000h\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\u0004\ufffd\u0017\ufffd\ufffd>\u0018\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd.V\ufffdL\ufffd4;\ufffd\ufffd\u02d9\ufffd-\ufffd\ufffdp\ufffd\ufffdh>\ufffd\u04024u\/Mte \ufffdh\ufffd\ufffd]]\ufffd\u0121\ufffdh\ufffdu\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\u065c\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.21, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��^g��{,�ǰR ��k�_��˷q�n��:P H+��L#Q��º/�l#�ra��TG��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��^g��{,�ǰR ��k�_��˷q�n��:P H+��L#Q��º/�l#�ra��TG��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��^g��{,�ǰR ��k�_��˷q�n��:P H+��L#Q��º/�l#�ra��TG��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 4.971895751573849, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "aff286fe0016fc5b4cfbc3188316098a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffd\u0005\u0004n\ufffd\ufffd:P\u0016 H+\ufffd\u0018\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffd\u0005\u0004n\ufffd\ufffd:P\u0016 H+\ufffd\u0018\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffd\u0005\u0004n\ufffd\ufffd:P\u0016 H+\ufffd\u0018\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34102af1828840ff334d3c746c9d4c6d7bfa87e7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffd\u0005\u0004n\ufffd\ufffd:P\u0016 H+\ufffd\u0018\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffdn\ufffd\ufffd:P H+\ufffd\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffd\u0005\u0004n\ufffd\ufffd:P\u0016 H+\ufffd\u0018\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd^g\ufffd\ufffd{,\ufffd\u01f0R\r\ufffd\ufffdk\ufffd_\ufffd\ufffd\u02f7q\ufffdn\ufffd\ufffd:P H+\ufffd\ufffd\ufffdL#Q\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00ba\/\ufffdl#\ufffdra\ufffd\ufffd\ufffdTG\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5061, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 5.08, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload �� ,6�3A� \|}Mi��n��$��_1å ��F6�N��;�ѤdD�~�8#�,��o3b��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��,6�3A�\|}Mi��n��$��_1å ��F6�N��;�ѤdD�~�8#�,��o3b��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �� ,6�3A� \|}Mi��n��$��_1å ��F6�N��;�ѤdD�~�8#�,��o3b��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.050802327724054, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "7bc09a306ce51bccaa231aca2df84e4b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000b\ufffd,6\ufffd3\u0019A\ufffd\f\|}Mi\ufffd\u001a\ufffd\u0003n\ufffd\ufffd\ufffd$\ufffd\u001a\ufffd_1\u00e5 \ufffd\ufffdF6\u001a\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd\u0010,\ufffd\ufffdo3\u0001b\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000b\ufffd,6\ufffd3\u0019A\ufffd\f\|}Mi\ufffd\u001a\ufffd\u0003n\ufffd\ufffd\ufffd$\ufffd\u001a\ufffd_1\u00e5 \ufffd\ufffdF6\u001a\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd\u0010,\ufffd\ufffdo3\u0001b\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000b\ufffd,6\ufffd3\u0019A\ufffd\f\|}Mi\ufffd\u001a\ufffd\u0003n\ufffd\ufffd\ufffd$\ufffd\u001a\ufffd_1\u00e5 \ufffd\ufffdF6\u001a\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd\u0010,\ufffd\ufffdo3\u0001b\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c4e340c5edbefc697f18872e45366cb21bc79821", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000b\ufffd,6\ufffd3\u0019A\ufffd\f\|}Mi\ufffd\u001a\ufffd\u0003n\ufffd\ufffd\ufffd$\ufffd\u001a\ufffd_1\u00e5 \ufffd\ufffdF6\u001a\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd\u0010,\ufffd\ufffdo3\u0001b\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd,6\ufffd3A\ufffd\|}Mi\ufffd\ufffdn\ufffd\ufffd\ufffd$\ufffd\ufffd_1\u00e5 \ufffd\ufffdF6\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd,\ufffd\ufffdo3b\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000b\ufffd,6\ufffd3\u0019A\ufffd\f\|}Mi\ufffd\u001a\ufffd\u0003n\ufffd\ufffd\ufffd$\ufffd\u001a\ufffd_1\u00e5 \ufffd\ufffdF6\u001a\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd\u0010,\ufffd\ufffdo3\u0001b\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd,6\ufffd3A\ufffd\|}Mi\ufffd\ufffdn\ufffd\ufffd\ufffd$\ufffd\ufffd_1\u00e5 \ufffd\ufffdF6\ufffdN\ufffd\ufffd;\ufffd\u0464dD\ufffd~\ufffd8#\ufffd,\ufffd\ufffdo3b\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.29, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��R U,T�Է$�ǣ��J��hB��3� &h�M�7 ��T1��zXVm�c��{�/}��%$��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��R U,T�Է$�ǣ��J��hB��3� &h�M�7 ��T1��zXVm�c��{�/}��%$��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��R U,T�Է$�ǣ��J��hB��3� &h�M�7 ��T1��zXVm�c��{�/}��%$��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.090445149322941, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "ecc8dd7c8da3bbc352158683c39c5345", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdh\u0019B\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXV\u0015m\u0011\ufffdc\u001e\ufffd\u0010\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd\u0012%\u000f\u0017$\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdh\u0019B\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXV\u0015m\u0011\ufffdc\u001e\ufffd\u0010\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd\u0012%\u000f\u0017$\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdh\u0019B\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXV\u0015m\u0011\ufffdc\u001e\ufffd\u0010\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd\u0012%\u000f\u0017$\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "126241c7c5c52185549527688f54df19b64f1c96", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdh\u0019B\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXV\u0015m\u0011\ufffdc\u001e\ufffd\u0010\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd\u0012%\u000f\u0017$\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdhB\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXVm\ufffdc\ufffd\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd%$\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdh\u0019B\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXV\u0015m\u0011\ufffdc\u001e\ufffd\u0010\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd\u0012%\u000f\u0017$\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdR U,T\ufffd\u0537$\ufffd\u01e3\ufffd\ufffdJ\ufffd\ufffdhB\ufffd\ufffd3\ufffd\n&h\ufffdM\ufffd7 \ufffd\ufffd\ufffdT1\ufffd\ufffdzXVm\ufffdc\ufffd\ufffd\ufffd\ufffd{\ufffd\/}\ufffd\ufffd%$\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.24, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload �6�ۄ��u��,��k��D;hEʕ�a�c��V �2̝�RbK�I��/�[=`h.6�$�2��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �6�ۄ��u��,��k��D;hEʕ�a�c��V �2̝�RbK�I��/�[=`h.6�$�2��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �6�ۄ��u��,��k��D;hEʕ�a�c��V �2̝�RbK�I��/�[=`h.6�$�2��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.056422948676857, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "13fc219ca06efc93b5ac71d839d21c80", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\u06c4\ufffd\u0006\ufffd\u0012u\ufffd\ufffd,\ufffd\ufffdk\ufffd\u000e\u001a\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \u0018\ufffd2\u031d\u001f\ufffdRbK\ufffdI\u0011\ufffd\ufffd\ufffd\/\ufffd[\u000f=\u0013`h.6\ufffd$\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\u06c4\ufffd\u0006\ufffd\u0012u\ufffd\ufffd,\ufffd\ufffdk\ufffd\u000e\u001a\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \u0018\ufffd2\u031d\u001f\ufffdRbK\ufffdI\u0011\ufffd\ufffd\ufffd\/\ufffd[\u000f=\u0013`h.6\ufffd$\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\u06c4\ufffd\u0006\ufffd\u0012u\ufffd\ufffd,\ufffd\ufffdk\ufffd\u000e\u001a\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \u0018\ufffd2\u031d\u001f\ufffdRbK\ufffdI\u0011\ufffd\ufffd\ufffd\/\ufffd[\u000f=\u0013`h.6\ufffd$\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "547cfb5fcfec77bbc428e882b7d5eb296d372b28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\u06c4\ufffd\u0006\ufffd\u0012u\ufffd\ufffd,\ufffd\ufffdk\ufffd\u000e\u001a\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \u0018\ufffd2\u031d\u001f\ufffdRbK\ufffdI\u0011\ufffd\ufffd\ufffd\/\ufffd[\u000f=\u0013`h.6\ufffd$\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd6\ufffd\u06c4\ufffd\ufffdu\ufffd\ufffd,\ufffd\ufffdk\ufffd\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \ufffd2\u031d\ufffdRbK\ufffdI\ufffd\ufffd\ufffd\/\ufffd[=`h.6\ufffd$\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\u06c4\ufffd\u0006\ufffd\u0012u\ufffd\ufffd,\ufffd\ufffdk\ufffd\u000e\u001a\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \u0018\ufffd2\u031d\u001f\ufffdRbK\ufffdI\u0011\ufffd\ufffd\ufffd\/\ufffd[\u000f=\u0013`h.6\ufffd$\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd6\ufffd\u06c4\ufffd\ufffdu\ufffd\ufffd,\ufffd\ufffdk\ufffd\ufffdD;hE\u0295\ufffda\ufffdc\ufffd\ufffdV \ufffd2\u031d\ufffdRb*K\ufffdI\ufffd\ufffd\ufffd\/\ufffd[=`h.6\ufffd$\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.19, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload �"�d��m�HP�� U]�@��VWN9� :�9%{l�ל��Q`�^m��o>g7��-��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �"�d��m�HP�� U]�@��VWN9� :�9%{l�ל��Q`�^m��o>g7��-��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �"�d��m�HP�� U]�@��VWN9� :�9%{l�ל��Q`�^m��o>g7��-��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.063172682262766, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "0f6e70c010799c5562c9053346ef9df0", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\u0003\ufffd\ufffd\tU]\ufffd@\ufffd\u0006\ufffd\u001b\u001fV\u0017WN9\ufffd :\u001c\ufffd9%{l\ufffd\u0006\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\u0011\ufffd\ufffdo>\u0013g7\ufffd\ufffd-\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\u0003\ufffd\ufffd\tU]\ufffd@\ufffd\u0006\ufffd\u001b\u001fV\u0017WN9\ufffd :\u001c\ufffd9%{l\ufffd\u0006\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\u0011\ufffd\ufffdo>\u0013g7\ufffd\ufffd-\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\u0003\ufffd\ufffd\tU]\ufffd@\ufffd\u0006\ufffd\u001b\u001fV\u0017WN9\ufffd :\u001c\ufffd9%{l\ufffd\u0006\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\u0011\ufffd\ufffdo>\u0013g7\ufffd\ufffd-\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2180d3e460f176fb02085b630c59e83a23e6a8ac", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\u0003\ufffd\ufffd\tU]\ufffd@\ufffd\u0006\ufffd\u001b\u001fV\u0017WN9\ufffd :\u001c\ufffd9%{l\ufffd\u0006\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\u0011\ufffd\ufffdo>\u0013g7\ufffd\ufffd-\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\ufffd\ufffd\tU]\ufffd@\ufffd\ufffdVWN9\ufffd :\ufffd9%{l\ufffd\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\ufffd\ufffdo>g7\ufffd\ufffd-\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\u0003\ufffd\ufffd\tU]\ufffd@\ufffd\u0006\ufffd\u001b\u001fV\u0017WN9\ufffd :\u001c\ufffd9%{l\ufffd\u0006\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\u0011\ufffd\ufffdo>\u0013g7\ufffd\ufffd-\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\"\ufffdd\ufffd\ufffdm\ufffdHP\ufffd\ufffd\ufffd\ufffd\tU]\ufffd@\ufffd\ufffdVWN9\ufffd :\ufffd9%{l\ufffd\u05dc\ufffd\ufffdQ`\ufffd^m\ufffd\ufffd\ufffdo>g7\ufffd\ufffd-\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.14, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �w�DXK�p��x��S>�'$�4�}J��OA 㐤{14C�ӣ��U�$}.(�W�ȡ5��=��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �w�DXK�p��x��S>�'$�4�}J��OA 㐤{14C�ӣ��U�$}.(�W�ȡ5��=��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �w�DXK�p��x��S>�'$�4�}J��OA 㐤{14C�ӣ��U�$}.(�W�ȡ5��=��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.030607586140274, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "17e9dea2462b4b17912544c82204ceac", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003w\ufffdDXK\u0013\ufffdp\ufffd\ufffdx\u0017\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffd\u0014O\u0011A \u0003\u3424\u0001{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\u0016\ufffd\ufffd=\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003w\ufffdDXK\u0013\ufffdp\ufffd\ufffdx\u0017\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffd\u0014O\u0011A \u0003\u3424\u0001{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\u0016\ufffd\ufffd=\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003w\ufffdDXK\u0013\ufffdp\ufffd\ufffdx\u0017\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffd\u0014O\u0011A \u0003\u3424\u0001{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\u0016\ufffd\ufffd=\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5942eda13f03c19aaf2e0b5f48771f6248635ee3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003w\ufffdDXK\u0013\ufffdp\ufffd\ufffdx\u0017\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffd\u0014O\u0011A \u0003\u3424\u0001{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\u0016\ufffd\ufffd=\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffdw\ufffdDXK\ufffdp\ufffd\ufffdx\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffdOA \u3424{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\ufffd\ufffd=\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003w\ufffdDXK\u0013\ufffdp\ufffd\ufffdx\u0017\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffd\u0014O\u0011A \u0003\u3424\u0001{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\u0016\ufffd\ufffd=\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdw\ufffdDXK\ufffdp\ufffd\ufffdx\ufffd\ufffdS>\ufffd'$\ufffd4\ufffd}J\ufffd\ufffdOA \u3424{14C\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdU\ufffd$}.(\ufffdW\ufffd\u02215\ufffd\ufffd=\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.07, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��f�%V��2�>Ziۇ��6�`��YG u;@�OG��"��ȓ�}] V�@(��(��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��f�%V��2�>Ziۇ��6�`��YG u;@�OG��"��ȓ�}] V�@(��(��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��f�%V��2�>Ziۇ��6�`��YG u;@�OG��"��ȓ�}] V�@(��(��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.069905131319153, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "76d5eee2fa584d71d3ed4d171679e968", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd\u00066\u0011\ufffd`\ufffd\ufffd\ufffd\ufffdYG \u001cu\u0013;@\ufffd\u001c\u0019OG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd\u000f}] \fV\ufffd@(\ufffd\ufffd\u001d(\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd\u00066\u0011\ufffd`\ufffd\ufffd\ufffd\ufffdYG \u001cu\u0013;@\ufffd\u001c\u0019OG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd\u000f}] \fV\ufffd@(\ufffd\ufffd\u001d(\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd\u00066\u0011\ufffd`\ufffd\ufffd\ufffd\ufffdYG \u001cu\u0013;@\ufffd\u001c\u0019OG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd\u000f}] \fV\ufffd@(\ufffd\ufffd\u001d(\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c0aea27e04bb75b8094f26e4fb8e792e73888c9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd\u00066\u0011\ufffd`\ufffd\ufffd\ufffd\ufffdYG \u001cu\u0013;@\ufffd\u001c\u0019OG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd\u000f}] \fV\ufffd@(\ufffd\ufffd\u001d(\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd6\ufffd`\ufffd\ufffd\ufffd\ufffdYG u;@\ufffdOG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd}] V\ufffd@(\ufffd\ufffd(\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd\u00066\u0011\ufffd`\ufffd\ufffd\ufffd\ufffdYG \u001cu\u0013;@\ufffd\u001c\u0019OG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd\u000f}] \fV\ufffd@(\ufffd\ufffd\u001d(\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdf\ufffd%V\ufffd\ufffd\ufffd2\ufffd>Zi\u06c7\ufffd\ufffd\ufffd\ufffd6\ufffd`\ufffd\ufffd\ufffd\ufffdYG u;@\ufffdOG\ufffd\ufffd\"\ufffd\ufffd\u0213\ufffd}] V\ufffd@(\ufffd\ufffd(\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 6.03, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �0�\|^ط�T��[�^�Z��uu�I9(1x�Ya ��o E��2P��zz�h"Ԙ}9��e�T�3��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �0�\|^ط�T��[�^�Z��uu�I9(1x�Ya ��o E��2P��zz�h"Ԙ}9��e�T�3��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �0�\|^ط�T��[�^�Z��uu�I9(1x�Ya ��o E��2P��zz�h"Ԙ}9��e�T�3��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.071195302987828, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5e9e7509d0274c904861e58edf652048", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\u0005\ufffd\|^\u0637\ufffd\u0001T\ufffd\ufffd\u0001[\ufffd^\ufffdZ\ufffd\ufffdu\u000eu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\u0002\ufffde\ufffdT\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\u0005\ufffd\|^\u0637\ufffd\u0001T\ufffd\ufffd\u0001[\ufffd^\ufffdZ\ufffd\ufffdu\u000eu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\u0002\ufffde\ufffdT\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\u0005\ufffd\|^\u0637\ufffd\u0001T\ufffd\ufffd\u0001[\ufffd^\ufffdZ\ufffd\ufffdu\u000eu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\u0002\ufffde\ufffdT\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "011a9b30d5d744b8caf60fa0477000a8d1de6935", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\u0005\ufffd\|^\u0637\ufffd\u0001T\ufffd\ufffd\u0001[\ufffd^\ufffdZ\ufffd\ufffdu\u000eu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\u0002\ufffde\ufffdT\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd0\ufffd\|^\u0637\ufffdT\ufffd\ufffd[\ufffd^\ufffdZ\ufffd\ufffduu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\ufffde\ufffdT\ufffd3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030\u0005\ufffd\|^\u0637\ufffd\u0001T\ufffd\ufffd\u0001[\ufffd^\ufffdZ\ufffd\ufffdu\u000eu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\u0002\ufffde\ufffdT\ufffd3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd0\ufffd\|^\u0637\ufffdT\ufffd\ufffd[\ufffd^\ufffdZ\ufffd\ufffduu\ufffdI9(1x\ufffdYa \ufffd\ufffdo\rE\ufffd\ufffd\ufffd\ufffd2P\ufffd\ufffd\ufffdzz\ufffdh\"\u0518}9\ufffd\ufffde\ufffdT\ufffd3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.98, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��j[ߓbL��x4�� 4@8�.5�$. ��ݿxoi���6��YQƥ��_D�j��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��j[ߓbL��x4��4@8�.5�$. ��ݿxoi���6��YQƥ��_D�j��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��j[ߓbL��x4�� 4@8�.5�$. ��ݿxoi���6��YQƥ��_D�j��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.018890842964637, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3a9f23ec3e4d31989c7f2d6591fffbd2", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj[\u07d3bL\u0012\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\f\ufffd\u001d\ufffd\u000b4@8\ufffd.5\ufffd\u001e\u0001$. \ufffd\ufffd\u077fx\u0015oi\ufffd\ufffd\ufffd\u0005\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\u0000\ufffdj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj[\u07d3bL\u0012\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\f\ufffd\u001d\ufffd\u000b4@8\ufffd.5\ufffd\u001e\u0001$. \ufffd\ufffd\u077fx\u0015oi\ufffd\ufffd\ufffd\u0005\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\u0000\ufffdj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj[\u07d3bL\u0012\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\f\ufffd\u001d\ufffd\u000b4@8\ufffd.5\ufffd\u001e\u0001$. \ufffd\ufffd\u077fx\u0015oi\ufffd\ufffd\ufffd\u0005\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\u0000\ufffdj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "91078eee95269b68c8a6ff52590e7dc048ba107e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj[\u07d3bL\u0012\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\f\ufffd\u001d\ufffd\u000b4@8\ufffd.5\ufffd\u001e\u0001$. \ufffd\ufffd\u077fx\u0015oi\ufffd\ufffd\ufffd\u0005\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\u0000\ufffdj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffdj[\u07d3bL\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4@8\ufffd.5\ufffd$. \ufffd\ufffd\u077fxoi\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\ufffdj\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj[\u07d3bL\u0012\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\f\ufffd\u001d\ufffd\u000b4@8\ufffd.5\ufffd\u001e\u0001$. \ufffd\ufffd\u077fx\u0015oi\ufffd\ufffd\ufffd\u0005\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\u0000\ufffdj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdj[\u07d3bL\ufffd\ufffdx4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4@8\ufffd.5\ufffd$. \ufffd\ufffd\u077fxoi\ufffd*\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffdYQ\u01a5\ufffd\ufffd_D\ufffdj\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.91, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��v�T��q��@�0q�ۣ��2-%$T� ��U�Lv��5A�ҍlb��~,�V�HJ��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��v�T��q��@�0q�ۣ��2-%$T� ��U�Lv��5A�ҍlb��~,�V�HJ��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��v�T��q��@�0q�ۣ��2-%$T� ��U�Lv��5A�ҍlb��~,�V�HJ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.01677635455211, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "100456ff8276ad625f32bcd7a4f5d28e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b\u0019\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\u0003\ufffd\u06e3\u0005\ufffd\ufffd\ufffd2-%\u0002\u000e$T\u000e\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\u0010\ufffd\ufffd~,\ufffdV\u0015\ufffdH\u0000J\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b\u0019\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\u0003\ufffd\u06e3\u0005\ufffd\ufffd\ufffd2-%\u0002\u000e$T\u000e\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\u0010\ufffd\ufffd~,\ufffdV\u0015\ufffdH\u0000J\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b\u0019\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\u0003\ufffd\u06e3\u0005\ufffd\ufffd\ufffd2-%\u0002\u000e$T\u000e\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\u0010\ufffd\ufffd~,\ufffdV\u0015\ufffdH\u0000J\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4d0b5964dbb9bf6f64c2e27789644c532afccc4e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b\u0019\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\u0003\ufffd\u06e3\u0005\ufffd\ufffd\ufffd2-%\u0002\u000e$T\u000e\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\u0010\ufffd\ufffd~,\ufffdV\u0015\ufffdH\u0000J\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\ufffd\u06e3\ufffd\ufffd\ufffd2-%$T\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\ufffd\ufffd~,\ufffdV\ufffdHJ\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\b\u0019\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\u0003\ufffd\u06e3\u0005\ufffd\ufffd\ufffd2-%\u0002\u000e$T\u000e\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\u0010\ufffd\ufffd~,\ufffdV\u0015\ufffdH\u0000J\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdv\ufffdT\ufffd\ufffdq\ufffd\ufffd@\ufffd0q\ufffd\u06e3\ufffd\ufffd\ufffd2-%$T\ufffd \ufffd\ufffd\ufffd\ufffdU\ufffdLv\ufffd\ufffd\ufffd\ufffd5A\ufffd\u048dlb\ufffd\ufffd\ufffd~,\ufffdV\ufffdHJ\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.86, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �R]?pjlo��#��t�сi4�m?�� S��:�\<K�D�ޱ��И]Qȥ�aFC�a��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �R]?pjlo��#��t�сi4�m?�� S��:�\<K�D�ޱ��И]Qȥ�aFC�a��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �R]?pjlo��#��t�сi4�m?�� S��:�\<K�D�ޱ��И]Qȥ�aFC�a��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.043267200016915, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "145548f6c4d43cf0033d0858a42d8d2c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003R]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441\u001bi\u00114\ufffd\u001cm?\ufffd\ufffd\ufffd\ufffd S\b\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003R]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441\u001bi\u00114\ufffd\u001cm?\ufffd\ufffd\ufffd\ufffd S\b\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003R]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441\u001bi\u00114\ufffd\u001cm?\ufffd\ufffd\ufffd\ufffd S\b\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d8fb6a74f432671c4cef965698fd10dd82ed87ff", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003R]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441\u001bi\u00114\ufffd\u001cm?\ufffd\ufffd\ufffd\ufffd S\b\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffdR]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441i4\ufffdm?\ufffd\ufffd\ufffd\ufffd S\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003R]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441\u001bi\u00114\ufffd\u001cm?\ufffd\ufffd\ufffd\ufffd S\b\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdR]?pjlo\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\u0441i4\ufffdm?\ufffd\ufffd\ufffd\ufffd S\ufffd\ufffd:\ufffd\\<K\ufffdD\ufffd\u07b1\ufffd\ufffd\ufffd\u0418]Q\u0225\ufffdaFC\ufffda\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.82, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��.0�g�Ň��j3X�o5"��"�&�� Q�RZB<Z+�!7� �j��D��V��~��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��.0�g�Ň��j3X�o5"��"�&�� Q�RZB<Z+�!7� �j��D��V��~��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��.0�g�Ň��j3X�o5"��"�&�� Q�RZB<Z+�!7� �j��D��V��~��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.023120404550389, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1c5bf44dc6541a88e28ea891e861eda1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\u001c\ufffdj3X\ufffdo5\"\b\ufffd\ufffd\ufffd\"\ufffd&\u0018\ufffd\u0006\ufffd\ufffd\ufffd \ufffd\u001dQ\u0002\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\u0015\u0003\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\u001c\ufffdj3X\ufffdo5\"\b\ufffd\ufffd\ufffd\"\ufffd&\u0018\ufffd\u0006\ufffd\ufffd\ufffd \ufffd\u001dQ\u0002\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\u0015\u0003\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\u001c\ufffdj3X\ufffdo5\"\b\ufffd\ufffd\ufffd\"\ufffd&\u0018\ufffd\u0006\ufffd\ufffd\ufffd \ufffd\u001dQ\u0002\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\u0015\u0003\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "806f4ca2d485594ee8315e3fa3f697833151e610", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\u001c\ufffdj3X\ufffdo5\"\b\ufffd\ufffd\ufffd\"\ufffd&\u0018\ufffd\u0006\ufffd\ufffd\ufffd \ufffd\u001dQ\u0002\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\u0015\u0003\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\ufffdj3X\ufffdo5\"\ufffd\ufffd\ufffd\"\ufffd&\ufffd\ufffd\ufffd\ufffd \ufffdQ\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\u001c\ufffdj3X\ufffdo5\"\b\ufffd\ufffd\ufffd\"\ufffd&\u0018\ufffd\u0006\ufffd\ufffd\ufffd \ufffd\u001dQ\u0002\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\u0015\u0003\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd.0\ufffdg\ufffd\u0147\ufffd\ufffdj3X\ufffdo5\"\ufffd\ufffd\ufffd\"\ufffd&\ufffd\ufffd\ufffd\ufffd \ufffdQ\ufffdRZB<Z+\ufffd!7\ufffd\t\ufffdj\ufffd\ufffdD\ufffd\ufffdV\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.77, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �t%4 /F�}� $��J�� ׊~�� W�a��s)n��'��!�� C��* ��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �t%4 /F�}� $��J��׊~�� W�a��s)n��'��!�� C��* ��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �t%4 /F�}� $��J�� ׊~�� W�a��s)n��'��!�� C��* ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.06833941251853, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ec80fa69c7b8137fd3b48c5a8cb05383", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003t%4\n\u0007\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u000b\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffd\u0011s)n\ufffd\ufffd\ufffd'\ufffd\u0012\ufffd\ufffd!\ufffd\ufffd\u0007\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003t%4\n\u0007\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u000b\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffd\u0011s)n\ufffd\ufffd\ufffd'\ufffd\u0012\ufffd\ufffd!\ufffd\ufffd\u0007\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003t%4\n\u0007\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u000b\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffd\u0011s)n\ufffd\ufffd\ufffd'\ufffd\u0012\ufffd\ufffd!\ufffd\ufffd\u0007\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8b3185482c2074e04449be4c8457c9d26656d8c9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003t%4\n\u0007\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u000b\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffd\u0011s)n\ufffd\ufffd\ufffd'\ufffd\u0012\ufffd\ufffd!\ufffd\ufffd\u0007\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffdt%4\n\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffds)n\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003t%4\n\u0007\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u000b\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffd\u0011s)n\ufffd\ufffd\ufffd'\ufffd\u0012\ufffd\ufffd!\ufffd\ufffd\u0007\ufffd\ufffd\n\ufffdC\ufffd\ufffd\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdt%4\n\/F\ufffd}\ufffd\n$\ufffd\ufffdJ\ufffd\ufffd\ufffd\u05ca~\ufffd\ufffd\n \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd W\ufffda\ufffd\ufffd\ufffd\ufffds)n\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd*\r\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.73, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �\_�� f"9��Nܯ?��y�� '�w.G��CH��iv0:��Ď�j�z]x��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �\_��f"9��Nܯ?��y�� '�w.G��CH��iv0:��Ď�j�z]x��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �\_�� f"9��Nܯ?��y�� '�w.G��CH��iv0:��Ď�j�z]x��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.060019371966195, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "77b3b1e75c0ca26c8e1978a2171ca502", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\u001c_\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffd\u001a\u001e\u001by\ufffd\ufffd\ufffd '\ufffdw.\u0016G\ufffd\ufffd\u0005\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\u0015\ufffd\u010e\ufffdj\ufffdz]x\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\u001c_\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffd\u001a\u001e\u001by\ufffd\ufffd\ufffd '\ufffdw.\u0016G\ufffd\ufffd\u0005\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\u0015\ufffd\u010e\ufffdj\ufffdz]x\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\u001c_\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffd\u001a\u001e\u001by\ufffd\ufffd\ufffd '\ufffdw.\u0016G\ufffd\ufffd\u0005\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\u0015\ufffd\u010e\ufffdj\ufffdz]x\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94a008e40e19d12eb33ee87d970ece13fb7b5f75", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\u001c_\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffd\u001a\u001e\u001by\ufffd\ufffd\ufffd '\ufffdw.\u0016G\ufffd\ufffd\u0005\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\u0015\ufffd\u010e\ufffdj\ufffdz]x\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\\_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd '\ufffdw.G\ufffd\ufffd\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\ufffd\u010e\ufffdj\ufffdz]x\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\u001c_\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffd\u001a\u001e\u001by\ufffd\ufffd\ufffd '\ufffdw.\u0016G\ufffd\ufffd\u0005\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\u0015\ufffd\u010e\ufffdj\ufffdz]x\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\\_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\"9\ufffd\ufffdN\u072f?\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd '\ufffdw.G\ufffd\ufffd\ufffdCH\ufffd\ufffd\u0087iv0:\ufffd\ufffd\u010e\ufffdj*\ufffdz]x\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.68, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �י��i��S��taS\a�Uf1G�� $1��f�i/>�yo�Z��+�B��>R�/� ��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �י��i��S��taS\a�Uf1G�� $1��f�i/>�yo�Z��+�B��>R�/� ��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �י��i��S��taS\a�Uf1G�� $1��f�i/>�yo�Z��+�B��>R�/� ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.079569468693139, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "14626982c7b1ebc3ab42ce0da58a17c7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05d9\ufffd\ufffd\u0005i\ufffd\ufffdS\u001b\ufffd\u001b\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\u001f\u000f\ufffd\ufffd\u000b \ufffd$1\ufffd\ufffdf\u0012\ufffd\u0002i\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05d9\ufffd\ufffd\u0005i\ufffd\ufffdS\u001b\ufffd\u001b\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\u001f\u000f\ufffd\ufffd\u000b \ufffd$1\ufffd\ufffdf\u0012\ufffd\u0002i\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05d9\ufffd\ufffd\u0005i\ufffd\ufffdS\u001b\ufffd\u001b\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\u001f\u000f\ufffd\ufffd\u000b \ufffd$1\ufffd\ufffdf\u0012\ufffd\u0002i\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e239b95b4930e9ef89964c35c626674c529870d0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05d9\ufffd\ufffd\u0005i\ufffd\ufffdS\u001b\ufffd\u001b\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\u001f\u000f\ufffd\ufffd\u000b \ufffd$1\ufffd\ufffdf\u0012\ufffd\u0002i\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\u05d9\ufffd\ufffdi\ufffd\ufffdS\ufffd\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd$1\ufffd\ufffdf\ufffdi\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05d9\ufffd\ufffd\u0005i\ufffd\ufffdS\u001b\ufffd\u001b\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\u001f\u000f\ufffd\ufffd\u000b \ufffd$1\ufffd\ufffdf\u0012\ufffd\u0002i\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\u05d9\ufffd\ufffdi\ufffd\ufffdS\ufffd\ufffdtaS\\a\ufffdUf1G\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd$1\ufffd\ufffdf\ufffdi\/>\ufffdyo\ufffdZ\ufffd\ufffd+\ufffdB\ufffd\ufffd>R\ufffd\/\ufffd\t\r\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.63, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��Fn�b��Μ��ۨ��fHn��i �� /��m�Q8�N��-M})��գ�OK�{M��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Fn�b��Μ��ۨ��fHn��i �� /��m�Q8�N��-M})��գ�OK�{M��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��Fn�b��Μ��ۨ��fHn��i �� /��m�Q8�N��-M})��գ�OK�{M��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.055553606837947, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "025f74889cb86e90c8afcdee6c68a988", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdFn\ufffd\u0017b\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\u0000\ufffdf\u0019Hn\ufffd\u0004\ufffd\ufffd\ufffdi \ufffd\ufffd\r\u0003\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\u0018\ufffd\ufffd\u0563\ufffdOK\ufffd{M\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdFn\ufffd\u0017b\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\u0000\ufffdf\u0019Hn\ufffd\u0004\ufffd\ufffd\ufffdi \ufffd\ufffd\r\u0003\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\u0018\ufffd\ufffd\u0563\ufffdOK\ufffd{M\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdFn\ufffd\u0017b\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\u0000\ufffdf\u0019Hn\ufffd\u0004\ufffd\ufffd\ufffdi \ufffd\ufffd\r\u0003\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\u0018\ufffd\ufffd\u0563\ufffdOK\ufffd{M\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcde5bc02e691b48d40e4ce0d2bf68db26a26d6b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdFn\ufffd\u0017b\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\u0000\ufffdf\u0019Hn\ufffd\u0004\ufffd\ufffd\ufffdi \ufffd\ufffd\r\u0003\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\u0018\ufffd\ufffd\u0563\ufffdOK\ufffd{M\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdFn\ufffdb\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\ufffdfHn\ufffd\ufffd\ufffd\ufffdi \ufffd\ufffd\r\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\ufffd\ufffd\u0563\ufffdOK\ufffd{M\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdFn\ufffd\u0017b\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\u0000\ufffdf\u0019Hn\ufffd\u0004\ufffd\ufffd\ufffdi \ufffd\ufffd\r\u0003\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\u0018\ufffd\ufffd\u0563\ufffdOK\ufffd{M\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdFn\ufffdb\ufffd\ufffd\u039c\ufffd\ufffd\u06e8\ufffd\ufffdfHn\ufffd\ufffd\ufffd\ufffdi \ufffd\ufffd\r\/\ufffd\ufffdm\ufffdQ8\ufffdN\ufffd\ufffd-M})\ufffd\ufffd\ufffd\ufffd\u0563\ufffdOK\ufffd{M\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.59, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �\G��p��A�:u"(��1!� e��MNH�5U�@�߾�/r�"�˧��ps��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �\G��p��A�:u"(��1!� e��MNH�5U�@�߾�/r�"�˧��ps��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �\G��p��A�:u"(��1!� e��MNH�5U�@�߾�/r�"�˧��ps��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.002151414150185, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4648ab1f8727f8a63e3a9dc91471506e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\G\ufffd\u0002\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0019\ufffd\u0012\u0006\ufffdA\ufffd\u0002:u\u0014\"(\ufffd\ufffd1!\ufffd\u0002 e\ufffd\ufffd\ufffdMNH\ufffd\u00025U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdp\u001cs\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\G\ufffd\u0002\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0019\ufffd\u0012\u0006\ufffdA\ufffd\u0002:u\u0014\"(\ufffd\ufffd1!\ufffd\u0002 e\ufffd\ufffd\ufffdMNH\ufffd\u00025U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdp\u001cs\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\G\ufffd\u0002\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0019\ufffd\u0012\u0006\ufffdA\ufffd\u0002:u\u0014\"(\ufffd\ufffd1!\ufffd\u0002 e\ufffd\ufffd\ufffdMNH\ufffd\u00025U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdp\u001cs\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a2e963c6b5dd08c419330056098aed2419bbb4f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\G\ufffd\u0002\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0019\ufffd\u0012\u0006\ufffdA\ufffd\u0002:u\u0014\"(\ufffd\ufffd1!\ufffd\u0002 e\ufffd\ufffd\ufffdMNH\ufffd\u00025U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdp\u001cs\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\\G\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:u\"(\ufffd\ufffd1!\ufffd e\ufffd\ufffd\ufffdMNH\ufffd5U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdps\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\G\ufffd\u0002\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0019\ufffd\u0012\u0006\ufffdA\ufffd\u0002:u\u0014\"(\ufffd\ufffd1!\ufffd\u0002 e\ufffd\ufffd\ufffdMNH\ufffd\u00025U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdp\u001cs\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\\G\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:u\"(\ufffd\ufffd1!\ufffd e\ufffd\ufffd\ufffdMNH\ufffd5U\ufffd@\ufffd\u07fe\ufffd\/r\ufffd\"\ufffd\u02e7\ufffd\ufffd\ufffd\ufffdps\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.52, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��X��f��˕!q�6`�?�RP�X�i�T.�� Ћ�?��o��9Te��/5F#D��q0�Sq��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��X��f��˕!q�6`�?�RP�X�i�T.�� Ћ�?��o��9Te��/5F#D��q0�Sq��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��X��f��˕!q�6`�?�RP�X�i�T.�� Ћ�?��o��9Te��/5F#D��q0�Sq��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.07216732724728, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5b2358af1f1b989f9c9bff081a43fe3a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffdf\ufffd\u000e\ufffd\u02d5\u0003!q\ufffd\u000e6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\b\u0013\ufffd\ufffdq0\ufffdS\u0014q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffdf\ufffd\u000e\ufffd\u02d5\u0003!q\ufffd\u000e6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\b\u0013\ufffd\ufffdq0\ufffdS\u0014q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffdf\ufffd\u000e\ufffd\u02d5\u0003!q\ufffd\u000e6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\b\u0013\ufffd\ufffdq0\ufffdS\u0014q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77b60c5dced77db6fe8fbc9625bfafc8e2164b9a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffdf\ufffd\u000e\ufffd\u02d5\u0003!q\ufffd\u000e6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\b\u0013\ufffd\ufffdq0\ufffdS\u0014q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffdX\ufffd\ufffdf\ufffd\ufffd\u02d5!q\ufffd6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\ufffd\ufffdq0\ufffdSq\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffdf\ufffd\u000e\ufffd\u02d5\u0003!q\ufffd\u000e6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\b\u0013\ufffd\ufffdq0\ufffdS\u0014q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdX\ufffd\ufffdf\ufffd\ufffd\u02d5!q\ufffd6`\ufffd?\ufffdRP\ufffdX\ufffdi\ufffdT.\ufffd\ufffd \u040b\ufffd?\ufffd\ufffd\ufffdo\ufffd\ufffd9Te\ufffd\ufffd\/5F#D\ufffd\ufffd\ufffdq0\ufffdSq\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.47, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �U#�q�M>+�\T��oW�3�v-d$ �@<� �-^�� >&3 ��Hv$�8j�C��_��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �U#�q�M>+�\T��oW�3�v-d$�@<� �-^�� >&3 ��Hv$�8j�C��_��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �U#�q�M>+�\T��oW�3�v-d$ �@<� �-^�� >&3 ��Hv$�8j�C��_��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.040655640238196, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "87025de598143ab5cde10bcc1f77ff45", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003U#\ufffdq\ufffdM>+\ufffd\\\u000fT\u001c\ufffd\u0000\ufffdoW\ufffd3\ufffdv-d$\f\ufffd@\u0006<\ufffd\u0002 \ufffd-\u0010^\u001c\u0005\ufffd\ufffd\n>\u001c&3\r\ufffd\u0010\ufffd\u0011\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003U#\ufffdq\ufffdM>+\ufffd\\\u000fT\u001c\ufffd\u0000\ufffdoW\ufffd3\ufffdv-d$\f\ufffd@\u0006<\ufffd\u0002 \ufffd-\u0010^\u001c\u0005\ufffd\ufffd\n>\u001c&3\r\ufffd\u0010\ufffd\u0011\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003U#\ufffdq\ufffdM>+\ufffd\\\u000fT\u001c\ufffd\u0000\ufffdoW\ufffd3\ufffdv-d$\f\ufffd@\u0006<\ufffd\u0002 \ufffd-\u0010^\u001c\u0005\ufffd\ufffd\n>\u001c&3\r\ufffd\u0010\ufffd\u0011\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9ab26074ca1e6c12bb740a715eadf5966211692e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003U#\ufffdq\ufffdM>+\ufffd\\\u000fT\u001c\ufffd\u0000\ufffdoW\ufffd3\ufffdv-d$\f\ufffd@\u0006<\ufffd\u0002 \ufffd-\u0010^\u001c\u0005\ufffd\ufffd\n>\u001c&3\r\ufffd\u0010\ufffd\u0011\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffdU#\ufffdq\ufffdM>+\ufffd\\T\ufffd\ufffdoW\ufffd3\ufffdv-d$\ufffd@<\ufffd \ufffd-^\ufffd\ufffd\n>&3\r\ufffd\ufffd\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003U#\ufffdq\ufffdM>+\ufffd\\\u000fT\u001c\ufffd\u0000\ufffdoW\ufffd3\ufffdv-d$\f\ufffd@\u0006<\ufffd\u0002 \ufffd-\u0010^\u001c\u0005\ufffd\ufffd\n>\u001c&3\r\ufffd\u0010\ufffd\u0011\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdU#\ufffdq\ufffdM>+\ufffd\\T\ufffd\ufffdoW\ufffd3\ufffdv-d$\ufffd@<\ufffd \ufffd-^\ufffd\ufffd\n>&3\r\ufffd\ufffd\ufffdHv$\ufffd8j\ufffdC\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.43, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ], "behavior_alert_count": 1, "behavior_priority": 84 }
26/07/2026 00:07:33 UTC	TCP	5061 · SIP TLS	sip-tls	Scan de ports port scan syn · via SIP TLS:5061 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload �e�ׁ�K7�I�{Β��Hx�j��z� ��am�ӈ"�#�l��uI%sB=�bYTj,��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �e�ׁ�K7�I�{Β��Hx�j��z� ��am�ӈ"�#�l��uI%sB=�bYTj,��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �e�ׁ�K7�I�{Β��Hx�j��z� ��am�ӈ"�#�l��uI%sB=�bYTj,��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 5.056458331724057, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f97568486c353b65640f0f1bb44aa87", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0004e\ufffd\u05c1\ufffd\u0005K7\ufffdI\ufffd{\u0392\ufffd\ufffd\u0000\ufffd\u001bHx\ufffdj\ufffd\u0015\ufffd\ufffd\u001e\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\u0006\ufffd\ufffduI%sB=\ufffd\u0010bYTj,\u0006\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0004e\ufffd\u05c1\ufffd\u0005K7\ufffdI\ufffd{\u0392\ufffd\ufffd\u0000\ufffd\u001bHx\ufffdj\ufffd\u0015\ufffd\ufffd\u001e\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\u0006\ufffd\ufffduI%sB=\ufffd\u0010bYTj,\u0006\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0004e\ufffd\u05c1\ufffd\u0005K7\ufffdI\ufffd{\u0392\ufffd\ufffd\u0000\ufffd\u001bHx\ufffdj\ufffd\u0015\ufffd\ufffd\u001e\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\u0006\ufffd\ufffduI%sB=\ufffd\u0010bYTj,\u0006\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d50965cfd3cfb3ca836e61f928676fe9f2ae8148", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0004e\ufffd\u05c1\ufffd\u0005K7\ufffdI\ufffd{\u0392\ufffd\ufffd\u0000\ufffd\u001bHx\ufffdj\ufffd\u0015\ufffd\ufffd\u001e\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\u0006\ufffd\ufffduI%sB=\ufffd\u0010bYTj,\u0006\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffde\ufffd\u05c1\ufffdK7\ufffdI\ufffd{\u0392\ufffd\ufffd\ufffdHx\ufffdj\ufffd\ufffd\ufffd\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\ufffd\ufffduI%sB=\ufffdbYTj,\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0004e\ufffd\u05c1\ufffd\u0005K7\ufffdI\ufffd{\u0392\ufffd\ufffd\u0000\ufffd\u001bHx\ufffdj\ufffd\u0015\ufffd\ufffd\u001e\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\u0006\ufffd\ufffduI%sB=\ufffd\u0010bYTj,\u0006\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "port scan syn \u00b7 via SIP TLS:5061 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffde\ufffd\u05c1\ufffdK7\ufffdI\ufffd{\u0392\ufffd\ufffd\ufffdHx\ufffdj\ufffd\ufffd\ufffd\ufffdz\ufffd \ufffd\ufffd\ufffd\ufffdam\ufffd\u04c8\"\ufffd#\ufffdl\ufffd\ufffduI%sB=\ufffdbYTj,\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.39, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��t��f�N�s��f�]?=��7��]�l��({ ��7:�d�4q> biH�o��c3U��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��t��f�N�s��f�]?=��7��]�l��({ ��7:�d�4q> biH�o��c3U��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��t��f�N�s��f�]?=��7��]�l��({ ��7:�d�4q> biH�o��c3U��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.093871672852778, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "419f2cae2201ca58d05c7cc26c6aa23a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffd\u000ef\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd\u001e7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \u0014\ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd\u00184q>\rbiH\ufffdo\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0014c3U\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffd\u000ef\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd\u001e7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \u0014\ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd\u00184q>\rbiH\ufffdo\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0014c3U\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffd\u000ef\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd\u001e7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \u0014\ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd\u00184q>\rbiH\ufffdo\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0014c3U\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cf582e5fd8d715ead0a1a3e454f3f7221b72f1a3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffd\u000ef\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd\u001e7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \u0014\ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd\u00184q>\rbiH\ufffdo\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0014c3U\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdt\ufffd\ufffdf\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd4q>\rbiH\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc3U\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffd\u000ef\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd\u001e7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \u0014\ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd\u00184q>\rbiH\ufffdo\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0014c3U\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdt\ufffd\ufffdf\ufffdN\ufffds\ufffd\ufffdf\ufffd]?=\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd]\ufffdl\ufffd\ufffd({ \ufffd\ufffd\ufffd\ufffd7:\ufffdd\ufffd4q>\rbiH\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc3U\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.19, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��Ԧ&�Je�T�q��N��&I]xj�:P"� � C~�R�h�8��;ss9�^�,���Ro9x�{�1��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ԧ&�Je�T�q��N��&I]xj�:P"� � C~�R�h�8��;ss9�^�,���Ro9x�{�1��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��Ԧ&�Je�T�q��N��&I]xj�:P"� � C~�R�h�8��;ss9�^�,���Ro9x�{�1��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.04472252004238, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "3cf6e4c83a1526b4f1283728a5f264e8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&\u0007I]xj\ufffd:P\"\ufffd\t\ufffd C~\u0019\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdR\u001do9x\ufffd{\ufffd1\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&\u0007I]xj\ufffd:P\"\ufffd\t\ufffd C~\u0019\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdR\u001do9x\ufffd{\ufffd1\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&\u0007I]xj\ufffd:P\"\ufffd\t\ufffd C~\u0019\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdR\u001do9x\ufffd{\ufffd1\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "08d0e877dd1ea4c647278993026ef193ab8681d8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&\u0007I]xj\ufffd:P\"\ufffd\t\ufffd C~\u0019\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdR\u001do9x\ufffd{\ufffd1\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&I]xj\ufffd:P\"\ufffd\t\ufffd C~\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdRo9x\ufffd{\ufffd1\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&\u0007I]xj\ufffd:P\"\ufffd\t\ufffd C~\u0019\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd\ufffdR\u001do9x\ufffd{\ufffd1\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\u0526&\ufffdJe\ufffdT\ufffdq\ufffd\ufffd\ufffdN\ufffd\ufffd&I]xj\ufffd:P\"\ufffd\t\ufffd C~\ufffdR\ufffdh\ufffd8\ufffd\ufffd;ss9\ufffd^\ufffd,\ufffd\ufffd*\ufffdRo9x\ufffd{\ufffd1\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.1, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5068 · TLS	tls	Scan de ports port scan syn · via TLS:5068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5068 Chemin / cible — Service TLS Payload ��Q(;�؝u{Eu��Mh��'̩բ�� umEB�� Qpc��ӻI簿� ��6b��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Q(;�؝u{Eu��Mh��'̩բ�� umEB�� Qpc��ӻI簿��6b��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��Q(;�؝u{Eu��Mh��'̩բ�� umEB�� Qpc��ӻI簿� ��6b��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.036320367293108, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cb21215fa76bc3e8ab7c97ff1aecd38c8adcbb7d", "event_fingerprint": "5298ac15d799dd342ad951eb7b96b48932b735e8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "0b894e3943785cb8d9ce57c3e0d0882f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ(;\ufffd\u061du{\u0006Eu\ufffd\u000f\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd u\u0014m\u0017EB\ufffd\ufffd\ufffd\n\ufffdQp\u0006c\ufffd\ufffd\u04fbI\u7c3f\u001b\ufffd\f\ufffd\ufffd6b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ(;\ufffd\u061du{\u0006Eu\ufffd\u000f\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd u\u0014m\u0017EB\ufffd\ufffd\ufffd\n\ufffdQp\u0006c\ufffd\ufffd\u04fbI\u7c3f\u001b\ufffd\f\ufffd\ufffd6b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ(;\ufffd\u061du{\u0006Eu\ufffd\u000f\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd u\u0014m\u0017EB\ufffd\ufffd\ufffd\n\ufffdQp\u0006c\ufffd\ufffd\u04fbI\u7c3f\u001b\ufffd\f\ufffd\ufffd6b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6fb838ff385c36ff7b94ef195973db18aca7e2e4", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ(;\ufffd\u061du{\u0006Eu\ufffd\u000f\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd u\u0014m\u0017EB\ufffd\ufffd\ufffd\n\ufffdQp\u0006c\ufffd\ufffd\u04fbI\u7c3f\u001b\ufffd\f\ufffd\ufffd6b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdQ(;\ufffd\u061du{Eu\ufffd\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd umEB\ufffd\ufffd\ufffd\n\ufffdQpc\ufffd\ufffd\u04fbI\u7c3f\ufffd\ufffd\ufffd6b\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ(;\ufffd\u061du{\u0006Eu\ufffd\u000f\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd u\u0014m\u0017EB\ufffd\ufffd\ufffd\n\ufffdQp\u0006c\ufffd\ufffd\u04fbI\u7c3f\u001b\ufffd\f\ufffd\ufffd6b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdQ(;\ufffd\u061du{Eu\ufffd\ufffdMh\ufffd\ufffd'\u0329\u0562\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd umEB\ufffd\ufffd\ufffd\n\ufffdQpc\ufffd\ufffd\u04fbI\u7c3f\ufffd\ufffd\ufffd6b\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 6.06, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5068 · TLS	tls	Scan de ports port scan syn · via TLS:5068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5068 Chemin / cible — Service TLS Payload ��@�Bx t��k�w�a�Gr�%�� ̓p��L �\n>�Z+f ��l��7Q��~�+WxmV�W��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��@�Bx t��k�w�a�Gr�%�� ̓p��L �\n>�Z+f ��l��7Q��~�+WxmV�W��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��@�Bx t��k�w�a�Gr�%�� ̓p��L �\n>�Z+f ��l��7Q��~�+WxmV�W��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.010270046529234, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cb21215fa76bc3e8ab7c97ff1aecd38c8adcbb7d", "event_fingerprint": "5298ac15d799dd342ad951eb7b96b48932b735e8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "0a704007a79ed956338830776b46590a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\u001a\ufffd\r\u0313\u001bp\ufffd\u0015\ufffdL\u0002 \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\u0014\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\u0001\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\u001a\ufffd\r\u0313\u001bp\ufffd\u0015\ufffdL\u0002 \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\u0014\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\u0001\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\u001a\ufffd\r\u0313\u001bp\ufffd\u0015\ufffdL\u0002 \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\u0014\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\u0001\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eed578d837c3573113320b634cccb5ac41f2e1e6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\u001a\ufffd\r\u0313\u001bp\ufffd\u0015\ufffdL\u0002 \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\u0014\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\u0001\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\ufffd\r\u0313p\ufffd\ufffdL \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\u001a\ufffd\r\u0313\u001bp\ufffd\u0015\ufffdL\u0002 \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\u0014\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\u0001\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd@\ufffdBx\rt\ufffd\ufffdk\ufffdw\ufffda\ufffdGr\ufffd%\ufffd\ufffd\r\u0313p\ufffd\ufffdL \ufffd\\n>\ufffdZ+f \ufffd\ufffdl\ufffd\ufffd7Q\ufffd\ufffd~\ufffd+WxmV\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 6.01, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5068 · TLS	tls	Scan de ports port scan syn · via TLS:5068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5068 Chemin / cible — Service TLS Payload � H��os�ސ� (��t��-{�B�'\e�[ @B=�u_��X��3�!\b��T��/�� ,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � H��os�ސ� (��t��-{�B�'\e�[ @B=�u_��X��3�!\b��T��/��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) � H��os�ސ� (��t��-{�B�'\e�[ @B=�u_��X��3�!\b��T��/�� ,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.061343831029676, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cb21215fa76bc3e8ab7c97ff1aecd38c8adcbb7d", "event_fingerprint": "5298ac15d799dd342ad951eb7b96b48932b735e8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "89407adbfe08c872a2609aee5f81aafc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\nH\ufffd\ufffd\ufffdos\u001e\ufffd\u0790\ufffd \u0003(\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\u000e\ufffd[ @B=\ufffdu_\ufffd\u0005\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\u0017\f\ufffd\u0005\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\nH\ufffd\ufffd\ufffdos\u001e\ufffd\u0790\ufffd \u0003(\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\u000e\ufffd[ @B=\ufffdu_\ufffd\u0005\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\u0017\f\ufffd\u0005\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\nH\ufffd\ufffd\ufffdos\u001e\ufffd\u0790\ufffd \u0003(\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\u000e\ufffd[ @B=\ufffdu_\ufffd\u0005\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\u0017\f\ufffd\u0005\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b5520fc72fa08287198e4f2e4523b31236df09e3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\nH\ufffd\ufffd\ufffdos\u001e\ufffd\u0790\ufffd \u0003(\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\u000e\ufffd[ @B=\ufffdu_\ufffd\u0005\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\u0017\f\ufffd\u0005\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\nH\ufffd\ufffd\ufffdos\ufffd\u0790\ufffd (\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\ufffd[ @B=\ufffdu_\ufffd\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\nH\ufffd\ufffd\ufffdos\u001e\ufffd\u0790\ufffd \u0003(\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\u000e\ufffd[ @B=\ufffdu_\ufffd\u0005\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\u0017\f\ufffd\u0005\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\nH\ufffd\ufffd\ufffdos\ufffd\u0790\ufffd (\ufffd\ufffdt\ufffd\ufffd-{\ufffdB\ufffd'\\e\ufffd[ @B=\ufffdu_\ufffd\ufffdX\ufffd\ufffd\ufffd3\ufffd!\\b\ufffd\ufffdT\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.97, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5068 · TLS	tls	Scan de ports port scan syn · via TLS:5068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5068 Chemin / cible — Service TLS Payload �\�O��`w��O��矄�%L�� %671Y�}e.��k[��e��U �t�n��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �\�O��`w��O��矄�%L�� %671Y�}e.��k[��e��U �t�n��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �\�O��`w��O��矄�%L�� %671Y�}e.��k[��e��U �t�n��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0365674536209095, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cb21215fa76bc3e8ab7c97ff1aecd38c8adcbb7d", "event_fingerprint": "5298ac15d799dd342ad951eb7b96b48932b735e8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "c470151afe4a55fad9b04784f8ec1c70", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffdO\ufffd\ufffd`w\u0012\ufffd\ufffd\u000e\u001b\ufffd\ufffd\ufffd\u0000\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\b\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\u0015\ufffd\ufffd\ufffde\u0007\ufffd\ufffd\ufffd\u0000\ufffdU\n\u0004\ufffdt\ufffdn\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffdO\ufffd\ufffd`w\u0012\ufffd\ufffd\u000e\u001b\ufffd\ufffd\ufffd\u0000\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\b\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\u0015\ufffd\ufffd\ufffde\u0007\ufffd\ufffd\ufffd\u0000\ufffdU\n\u0004\ufffdt\ufffdn\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffdO\ufffd\ufffd`w\u0012\ufffd\ufffd\u000e\u001b\ufffd\ufffd\ufffd\u0000\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\b\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\u0015\ufffd\ufffd\ufffde\u0007\ufffd\ufffd\ufffd\u0000\ufffdU\n\u0004\ufffdt\ufffdn\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0f13639450c771ae1b710267d13fbf1c5983e87e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffdO\ufffd\ufffd`w\u0012\ufffd\ufffd\u000e\u001b\ufffd\ufffd\ufffd\u0000\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\b\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\u0015\ufffd\ufffd\ufffde\u0007\ufffd\ufffd\ufffd\u0000\ufffdU\n\u0004\ufffdt\ufffdn\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\\\ufffdO\ufffd\ufffd`w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdU\n\ufffdt\ufffdn\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffdO\ufffd\ufffd`w\u0012\ufffd\ufffd\u000e\u001b\ufffd\ufffd\ufffd\u0000\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\b\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\u0015\ufffd\ufffd\ufffde\u0007\ufffd\ufffd\ufffd\u0000\ufffdU\n\u0004\ufffdt\ufffdn\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\\\ufffdO\ufffd\ufffd`w\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\u77c4\ufffd%L\ufffd\ufffd %671Y\ufffd}e.\ufffd\ufffdk[\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdU\n\ufffdt\ufffdn\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.93, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��ɒ�R\|F��A��Ne܄�6�)�h8#o� �7��,�X`��iצ�C�9���n,��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ɒ�R\|F��A��Ne܄�6�)�h8#o� �7��,�X`��iצ�C�9���n,��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��ɒ�R\|F��A��Ne܄�6�)�h8#o� �7��,�X`��iצ�C�9���n,��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0542919042869885, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "34f0726179d917a49b072085e1eedbf2", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0252\ufffdR\|F\ufffd\ufffd\u0005\ufffdA\ufffd\u0014\ufffdN\u0010e\u0704\ufffd6\ufffd\u0014)\ufffdh\u001b8#o\ufffd \ufffd7\u001f\ufffd\ufffd\ufffd\u0012,\ufffdX\u0018`\u001c\ufffd\u001f\ufffdi\u05e6\ufffdC\ufffd\u001a9\ufffd\ufffd\ufffdn,\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0252\ufffdR\|F\ufffd\ufffd\u0005\ufffdA\ufffd\u0014\ufffdN\u0010e\u0704\ufffd6\ufffd\u0014)\ufffdh\u001b8#o\ufffd \ufffd7\u001f\ufffd\ufffd\ufffd\u0012,\ufffdX\u0018`\u001c\ufffd\u001f\ufffdi\u05e6\ufffdC\ufffd\u001a9\ufffd\ufffd\ufffdn,\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0252\ufffdR\|F\ufffd\ufffd\u0005\ufffdA\ufffd\u0014\ufffdN\u0010e\u0704\ufffd6\ufffd\u0014)\ufffdh\u001b8#o\ufffd \ufffd7\u001f\ufffd\ufffd\ufffd\u0012,\ufffdX\u0018`\u001c\ufffd\u001f\ufffdi\u05e6\ufffdC\ufffd\u001a9\ufffd\ufffd\ufffdn,\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "032177fc8c565269d0e93aaf76646fb4f1f83322", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0252\ufffdR\|F\ufffd\ufffd\u0005\ufffdA\ufffd\u0014\ufffdN\u0010e\u0704\ufffd6\ufffd\u0014)\ufffdh\u001b8#o\ufffd \ufffd7\u001f\ufffd\ufffd\ufffd\u0012,\ufffdX\u0018`\u001c\ufffd\u001f\ufffdi\u05e6\ufffdC\ufffd\u001a9\ufffd\ufffd\ufffdn,\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u0252\ufffdR\|F\ufffd\ufffd\ufffdA\ufffd\ufffdNe\u0704\ufffd6\ufffd)\ufffdh8#o\ufffd \ufffd7\ufffd\ufffd\ufffd,\ufffdX`\ufffd\ufffdi\u05e6\ufffdC\ufffd9\ufffd\ufffd\ufffdn,\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0252\ufffdR\|F\ufffd\ufffd\u0005\ufffdA\ufffd\u0014\ufffdN\u0010e\u0704\ufffd6\ufffd\u0014)\ufffdh\u001b8#o\ufffd \ufffd7\u001f\ufffd\ufffd\ufffd\u0012,\ufffdX\u0018`\u001c\ufffd\u001f\ufffdi\u05e6\ufffdC\ufffd\u001a9\ufffd\ufffd\ufffdn,\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\u0252\ufffdR\|F\ufffd\ufffd\ufffdA\ufffd\ufffdNe\u0704\ufffd6\ufffd)\ufffdh8#o\ufffd \ufffd7\ufffd\ufffd\ufffd,\ufffdX`\ufffd\ufffdi\u05e6\ufffdC\ufffd9\ufffd\ufffd*\ufffdn,\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.88, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5068 · TLS	tls	Scan de ports port scan syn · via TLS:5068 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5068 Chemin / cible — Service TLS Payload �$'��\|t!�?+k8�n��Fb��ܨ��'v� � �AZ��ڂq�;2.��M׊CW2��vh}��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �$'��\|t!�?+k8�n��Fb��ܨ��'v� ��AZ��ڂq�;2.��M׊CW2��vh}��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �$'��\|t!�?+k8�n��Fb��ܨ��'v� � �AZ��ڂq�;2.��M׊CW2��vh}��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.049278860642926, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5068, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cb21215fa76bc3e8ab7c97ff1aecd38c8adcbb7d", "event_fingerprint": "5298ac15d799dd342ad951eb7b96b48932b735e8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "4e99872ea434bfc808e0fa96f92fd84a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5068, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\b\u000b\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd\u001d;2.\ufffd\u001f\ufffdM\u05caCW2\ufffd\ufffdv\u0016h}\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\b\u000b\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd\u001d;2.\ufffd\u001f\ufffdM\u05caCW2\ufffd\ufffdv\u0016h}\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\b\u000b\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd\u001d;2.\ufffd\u001f\ufffdM\u05caCW2\ufffd\ufffdv\u0016h}\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "31241e9b20d62f38020ee43ad2b7ce15659b6951", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\b\u000b\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd\u001d;2.\ufffd\u001f\ufffdM\u05caCW2\ufffd\ufffdv\u0016h}\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd;2.\ufffd\ufffdM\u05caCW2\ufffd\ufffdvh}\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5068, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\b\u000b\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd\u001d;2.\ufffd\u001f\ufffdM\u05caCW2\ufffd\ufffdv\u0016h}\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5068, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5068 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd$'\ufffd\ufffd\|t!\ufffd?+k8\ufffdn\ufffd\ufffdFb\ufffd\ufffd\ufffd\u0728\ufffd\ufffd\ufffd\ufffd'v\ufffd \ufffd\ufffdAZ\ufffd\ufffd\ufffd\u0682q\ufffd;2.\ufffd\ufffdM\u05caCW2\ufffd\ufffdvh}\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5068 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5068" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.84, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��@j�d��g9�5��3΍��#� �v�'�6��XM�F3�q)R�Va4po��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��@j�d��g9�5��3΍��#� �v�'�6��XM�F3�q)R�Va4po��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ��@j�d��g9�5��3΍��#� �v�'�6��XM�F3�q)R�Va4po��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0233662669086385, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "4bf6e6ee0ae76f9e0169bcd271e1f407", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017@j\ufffdd\ufffd\ufffd\ufffd\u0012\u0007\ufffd\u001e\ufffd\u000f\ufffdg\u00159\ufffd5\ufffd\ufffd3\u038d\ufffd\u001d\ufffd#\ufffd\u0018 \ufffdv\u001a\ufffd'\ufffd6\ufffd\ufffdXM\u0006\ufffdF3\ufffd\u0002q)R\ufffdV\u0000a4p\u0012o\ufffd\u0015\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017@j\ufffdd\ufffd\ufffd\ufffd\u0012\u0007\ufffd\u001e\ufffd\u000f\ufffdg\u00159\ufffd5\ufffd\ufffd3\u038d\ufffd\u001d\ufffd#\ufffd\u0018 \ufffdv\u001a\ufffd'\ufffd6\ufffd\ufffdXM\u0006\ufffdF3\ufffd\u0002q)R\ufffdV\u0000a4p\u0012o\ufffd\u0015\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017@j\ufffdd\ufffd\ufffd\ufffd\u0012\u0007\ufffd\u001e\ufffd\u000f\ufffdg\u00159\ufffd5\ufffd\ufffd3\u038d\ufffd\u001d\ufffd#\ufffd\u0018 \ufffdv\u001a\ufffd'\ufffd6\ufffd\ufffdXM\u0006\ufffdF3\ufffd\u0002q)R\ufffdV\u0000a4p\u0012o\ufffd\u0015\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98924b95778ff9048a3f4db49897aa9a4e1eee0a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017@j\ufffdd\ufffd\ufffd\ufffd\u0012\u0007\ufffd\u001e\ufffd\u000f\ufffdg\u00159\ufffd5\ufffd\ufffd3\u038d\ufffd\u001d\ufffd#\ufffd\u0018 \ufffdv\u001a\ufffd'\ufffd6\ufffd\ufffdXM\u0006\ufffdF3\ufffd\u0002q)R\ufffdV\u0000a4p\u0012o\ufffd\u0015\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd@j\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg9\ufffd5\ufffd\ufffd3\u038d\ufffd\ufffd#\ufffd \ufffdv\ufffd'\ufffd6\ufffd\ufffdXM\ufffdF3\ufffdq)R\ufffdVa4po\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017@j\ufffdd\ufffd\ufffd\ufffd\u0012\u0007\ufffd\u001e\ufffd\u000f\ufffdg\u00159\ufffd5\ufffd\ufffd3\u038d\ufffd\u001d\ufffd#\ufffd\u0018 \ufffdv\u001a\ufffd'\ufffd6\ufffd\ufffdXM\u0006\ufffdF3\ufffd\u0002q)R\ufffdV\u0000a4p\u0012o\ufffd\u0015\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd@j\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg9\ufffd5\ufffd\ufffd3\u038d\ufffd\ufffd#\ufffd \ufffdv\ufffd'\ufffd6\ufffd\ufffdXM\ufffdF3\ufffdq)R\ufffdVa4po\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.8, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ���ɧ�k/@���`lb�<�A��i�ȉ� ��4 �� lj~nnQ��5L��n?��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ���ɧ�k/@���`lb�<�A��i�ȉ� ��4 �� lj~nnQ��5L��n?��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) ���ɧ�k/@���`lb�<�A��i�ȉ� ��4 �� lj~nnQ��5L��n?��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.0268262738416905, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "a5621850b3932749238f16e8f4d44e15", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0267\ufffdk\u0001\/@\ufffd\ufffd\ufffd\u0001\ufffd`lb\ufffd<\u0014\ufffdA\u0019\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\b\u0005\ufffd\ufffd4\r\ufffd\ufffd\nl\u0006j~nnQ\ufffd\ufffd\ufffd\u00035L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0267\ufffdk\u0001\/@\ufffd\ufffd\ufffd\u0001\ufffd`lb\ufffd<\u0014\ufffdA\u0019\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\b\u0005\ufffd\ufffd4\r\ufffd\ufffd\nl\u0006j~nnQ\ufffd\ufffd\ufffd\u00035L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0267\ufffdk\u0001\/@\ufffd\ufffd\ufffd\u0001\ufffd`lb\ufffd<\u0014\ufffdA\u0019\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\b\u0005\ufffd\ufffd4\r\ufffd\ufffd\nl\u0006j~nnQ\ufffd\ufffd\ufffd\u00035L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0884657fa0f60f6749e5d3887d9ef409d4e5f716", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0267\ufffdk\u0001\/@\ufffd\ufffd\ufffd\u0001\ufffd`lb\ufffd<\u0014\ufffdA\u0019\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\b\u0005\ufffd\ufffd4\r\ufffd\ufffd\nl\u0006j~nnQ\ufffd\ufffd\ufffd\u00035L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\u0267\ufffdk\/@\ufffd\ufffd\ufffd\ufffd`lb\ufffd<\ufffdA\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\ufffd\ufffd4\r\ufffd\ufffd\nlj~nnQ\ufffd\ufffd\ufffd5L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0267\ufffdk\u0001\/@\ufffd\ufffd\ufffd\u0001\ufffd`lb\ufffd<\u0014\ufffdA\u0019\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\b\u0005\ufffd\ufffd4\r\ufffd\ufffd\nl\u0006j~nnQ\ufffd\ufffd\ufffd\u00035L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\u0267\ufffdk\/@\ufffd\ufffd\ufffd\ufffd`lb\ufffd<\ufffdA\ufffd\ufffdi\ufffd\u0209\ufffd \ufffd\ufffd\ufffd4\r\ufffd\ufffd\nlj~nnQ\ufffd\ufffd\ufffd5L\ufffd\ufffd\ufffd\ufffdn?\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.76, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
26/07/2026 00:07:33 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 cc61f04eb7a2e049 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload �l/�p��vA_@�a�ª˳kZ1C1�@��l��_ ��k�� )�}�c�'܌��x�9��^�@��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �l/�p��vA_@�a�ª˳kZ1C1�@��l��_ ��k��)�}�c�'܌��x�9��^�@��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �l/�p��vA_@�a�ª˳kZ1C1�@��l��_ ��k�� )�}�c�'܌��x�9��^�@��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 24, "bytes_in": 517, "payload_entropy": 5.064602526906671, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3e0ab3b51f8f1177ae737ac628a22f1158fbc9a2", "event_fingerprint": "10ac9f840b9a38a8cd35f5a63f4e34df0d610e4d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "payload_hash": "5026aa644c27a56d628b2482ea55e1c2", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\/\ufffdp\ufffd\ufffd\u0017vA_@\ufffda\ufffd\u00aa\u001e\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\u000b\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\/\ufffdp\ufffd\ufffd\u0017vA_@\ufffda\ufffd\u00aa\u001e\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\u000b\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\/\ufffdp\ufffd\ufffd\u0017vA_@\ufffda\ufffd\u00aa\u001e\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\u000b\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d889b628ff759eef34404f72099532fca7568313", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\/\ufffdp\ufffd\ufffd\u0017vA_@\ufffda\ufffd\u00aa\u001e\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\u000b\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdl\/\ufffdp\ufffd\ufffdvA_@\ufffda\ufffd\u00aa\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003l\/\ufffdp\ufffd\ufffd\u0017vA_@\ufffda\ufffd\u00aa\u001e\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\u000b\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffdl\/\ufffdp\ufffd\ufffdvA_@\ufffda\ufffd\u00aa\u02f3kZ1C1\ufffd@\ufffd\ufffdl\ufffd\ufffd_ \ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd)\ufffd}\ufffdc\ufffd'\u070c\ufffd\ufffdx\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd@\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 5061, 5062, 5063, 5065, 5066, 5068 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 5.72, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }

185.243.5.8

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence