|
|
TCP |
5094 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5094 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5094
Chemin / cible
—
Service
TLS
Payload
� ��Z�:�lJ'Q�_j^> H�7I���Wh(�; ���9<wjŚ 9)��Mt�D�B������� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Z�:�lJ'Q�_j^> H�7I���Wh(�; ���9<wjŚ
9)��Mt�D�B������� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��Z�:�lJ'Q�_j^> H�7I���Wh(�; ���9<wjŚ 9)��Mt�D�B������� �+�/�,�0̨̩� �� � _ � � 2 + 3������={������Z�tX���U5�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.718506732263121,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5094,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "801c99ed0127697955df65e6503b7b89b5b2586c",
"event_fingerprint": "27fa9719af6b97df96fb4f0b969630ad0d5c9a1e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "a5a07d420523e5dd2eaed17aedfaa5ac",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5094,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019\ufffdZ\ufffd\u0017:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffd\u001bWh(\ufffd\u0007\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffd\u0017Mt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u0003\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019\ufffdZ\ufffd\u0017:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffd\u001bWh(\ufffd\u0007\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffd\u0017Mt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u0003\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u001b\ufffd={\ufffd\ufffd\ufffd\u0001\u0016\ufffd\ufffd\ufffdZ\ufffdtX\ufffd\u0001\ufffd\ufffdU5\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019\ufffdZ\ufffd\u0017:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffd\u001bWh(\ufffd\u0007\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffd\u0017Mt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u0003\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61a6f414e5850862da0d02a8c6bbf7801b1c6896",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019\ufffdZ\ufffd\u0017:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffd\u001bWh(\ufffd\u0007\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffd\u0017Mt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u0003\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5094,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdZ\ufffd:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffdWh(\ufffd\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffdMt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5094 \u00b7 (reconnaissance)",
"target_port_label": "5094 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5094,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0019\ufffdZ\ufffd\u0017:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffd\u001bWh(\ufffd\u0007\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffd\u0017Mt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u0003\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5094,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5094 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdZ\ufffd:\ufffdlJ'Q\ufffd_j^> H\ufffd7I\ufffd\ufffd\ufffdWh(\ufffd\u037e \ufffd\ufffd\ufffd9<wj\u015a \n9)\ufffd\ufffdMt\ufffdD\ufffdB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5094 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5094"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 29,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 29,
"scan_velocity_ports_per_s": 133.79,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5088 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5088
Chemin / cible
—
Service
TLS
Payload
� ��]� � � �D���~a���6<��Q_�_EUԺb ��� �WM��_J�$��2�_&X&�+�l� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��]� �
� �D���~a���6<��Q_�_EUԺb ��� �WM��_J�$��2�_&X&�+�l� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��]� � � �D���~a���6<��Q_�_EUԺb ��� �WM��_J�$��2�_&X&�+�l� �+�/�,�0̨̩� �� � _ � � 2 + 3�����RA� C$Y� ̔������
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.715471243148279,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7cdd78b6ab4014f9c07d1a7bf6f66702134abd6e",
"event_fingerprint": "2d00728c5fe7d1cb6a6fc969857c2152921d2be0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "4c10d21804d2eb9e64a2f25c10a369a9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5088,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd]\ufffd\u001d\ufffd\r\ufffd\u001c\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab\u0003 \ufffd\ufffd\ufffd\u0002\u001c\ufffdWM\u0013\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&\u0007X&\ufffd+\ufffd\u001al\ufffd\u001c\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd]\ufffd\u001d\ufffd\r\ufffd\u001c\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab\u0003 \ufffd\ufffd\ufffd\u0002\u001c\ufffdWM\u0013\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&\u0007X&\ufffd+\ufffd\u001al\ufffd\u001c\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdRA\ufffd\u0000\u0016\u2effC$Y\ufffd\f\u001f\u0314\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd]\ufffd\u001d\ufffd\r\ufffd\u001c\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab\u0003 \ufffd\ufffd\ufffd\u0002\u001c\ufffdWM\u0013\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&\u0007X&\ufffd+\ufffd\u001al\ufffd\u001c\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f007707e236f109b35b8b9a10a7ab3b653db6c5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd]\ufffd\u001d\ufffd\r\ufffd\u001c\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab\u0003 \ufffd\ufffd\ufffd\u0002\u001c\ufffdWM\u0013\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&\u0007X&\ufffd+\ufffd\u001al\ufffd\u001c\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5088,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd]\ufffd\ufffd\r\ufffd\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab \ufffd\ufffd\ufffd\ufffdWM\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&X&\ufffd+\ufffdl\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5088 \u00b7 (reconnaissance)",
"target_port_label": "5088 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd]\ufffd\u001d\ufffd\r\ufffd\u001c\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab\u0003 \ufffd\ufffd\ufffd\u0002\u001c\ufffdWM\u0013\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&\u0007X&\ufffd+\ufffd\u001al\ufffd\u001c\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5088,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5088 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd]\ufffd\ufffd\r\ufffd\ufffdD\ufffd\ufffd\ufffd~a\ufffd\ufffd\ufffd6<\ufffd\ufffdQ_\ufffd_EU\u053ab \ufffd\ufffd\ufffd\ufffdWM\ufffd\ufffd_J\ufffd$\ufffd\ufffd2\ufffd_&X&\ufffd+\ufffdl\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5088 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 30,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 30,
"scan_velocity_ports_per_s": 134.5,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5097 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5097 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5097
Chemin / cible
—
Service
TLS
Payload
� ��;��@�i�� �ԭ���3���RH���@��� ��N��� �D�炀C\��w�����r�&�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma DNP3 link
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��;��@�i��
�ԭ���3���RH���@��� ��N���
�D�炀C\��w�����r�&�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��;��@�i�� �ԭ���3���RH���@��� ��N��� �D�炀C\��w�����r�&�� �+�/�,�0̨̩� �� � _ � � 2 + 3�����L �@�tLsA˚��d�����m
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.701891477165373,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5097,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "554bc5dea16b43cf26da6d920dc36140b847e7c5",
"event_fingerprint": "aad35188ce2210bb52483ca56f27aa54133d98a5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0794",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Sigma DNP3 link",
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0794",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "7897219b29da7cc8b533ca7407947e0c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5097,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\u0004\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffd\u0005D\u001a\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\u0005&\ufffd\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\u0004\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffd\u0005D\u001a\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\u0005&\ufffd\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdL\b\n\ufffd@\ufffdtLsA\u02da\u0003\ufffd\ufffdd\ufffd\u000f\ufffd\ufffd\ufffd\u0003\ufffdm",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\u0004\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffd\u0005D\u001a\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\u0005&\ufffd\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a017b461ddae07ec961c21734b7b65c88f35831f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\u0004\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffd\u0005D\u001a\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\u0005&\ufffd\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5097,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffdD\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd&\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5097 \u00b7 (reconnaissance)",
"target_port_label": "5097 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5097,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\u0004\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffd\u0005D\u001a\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\u0005&\ufffd\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5097,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5097 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffd\ufffd@\ufffdi\ufffd\ufffd\n\ufffd\u052d\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdRH\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd \ufffd\ufffdN\ufffd\ufffd\ufffd\n\ufffdD\ufffd\u7080C\\\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd&\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5097 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5097"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 31,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 31,
"scan_velocity_ports_per_s": 135.1,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5084 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5084 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5084
Chemin / cible
—
Service
TLS
Payload
� �n�úo�~?��D�[P�{��U��9��Ypp �ϐ��04�� ]��G����� �9, �~-! �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �n�úo�~?��D�[P�{��U��9��Ypp �ϐ��04�� ]��G����� �9, �~-! �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �n�úo�~?��D�[P�{��U��9��Ypp �ϐ��04�� ]��G����� �9, �~-! �+�/�,�0̨̩� �� � _ � � 2 + 3����Fw��jy�:w9& )<< �k�)A�U
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.732053784453718,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6c6a3a7e6ac43e74e858be8105ecb05f44775db5",
"event_fingerprint": "a79b81a67968b9886c57e501c49895a58ba9452d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "4649d8c63dbf96f7e7726ced06376b25",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5084,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\bn\ufffd\u00fao\ufffd~\u001b?\ufffd\ufffdD\u0013\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd\f]\ufffd\ufffdG\ufffd\ufffd\u0005\ufffd\u0006\ufffd\ufffd\u001f\ufffd9\u0007,\u001e\ufffd~-!\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\bn\ufffd\u00fao\ufffd~\u001b?\ufffd\ufffdD\u0013\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd\f]\ufffd\ufffdG\ufffd\ufffd\u0005\ufffd\u0006\ufffd\ufffd\u001f\ufffd9\u0007,\u001e\ufffd~-!\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdFw\ufffd\ufffdjy\ufffd:w9&\f)<<\u000f\t\ufffdk\ufffd)A\u0013\ufffdU",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\bn\ufffd\u00fao\ufffd~\u001b?\ufffd\ufffdD\u0013\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd\f]\ufffd\ufffdG\ufffd\ufffd\u0005\ufffd\u0006\ufffd\ufffd\u001f\ufffd9\u0007,\u001e\ufffd~-!\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aff4fd049261442b26f5c361f511bc9339fa38bc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\bn\ufffd\u00fao\ufffd~\u001b?\ufffd\ufffdD\u0013\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd\f]\ufffd\ufffdG\ufffd\ufffd\u0005\ufffd\u0006\ufffd\ufffd\u001f\ufffd9\u0007,\u001e\ufffd~-!\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5084,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdn\ufffd\u00fao\ufffd~?\ufffd\ufffdD\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd]\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9,\ufffd~-!\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5084 \u00b7 (reconnaissance)",
"target_port_label": "5084 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5084,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\bn\ufffd\u00fao\ufffd~\u001b?\ufffd\ufffdD\u0013\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd\f]\ufffd\ufffdG\ufffd\ufffd\u0005\ufffd\u0006\ufffd\ufffd\u001f\ufffd9\u0007,\u001e\ufffd~-!\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5084,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5084 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdn\ufffd\u00fao\ufffd~?\ufffd\ufffdD\ufffd[P\ufffd{\u008f\ufffd\ufffdU\ufffd\ufffd9\ufffd\ufffdYpp \ufffd\u03d0\ufffd\ufffd04\ufffd\ufffd]\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9,\ufffd~-!\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5084 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 32,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 32,
"scan_velocity_ports_per_s": 135.53,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5079 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5079 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5079
Chemin / cible
—
Service
TLS
Payload
� ����$W�貺���ӁW^zuggpU��d�x�� ����1�8�1T�� ��? !�����;�驐�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����$W�貺���ӁW^zuggpU��d�x�� ����1�8�1T�� ��?
!�����;�驐�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ����$W�貺���ӁW^zuggpU��d�x�� ����1�8�1T�� ��? !�����;�驐�� �+�/�,�0̨̩� �� � _ � � 2 + 3�����2x��{G���T�$�K�I�%}���
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.706327227264487,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5079,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e364b1be919f4c2b594b6f77a296b0d1f3237de9",
"event_fingerprint": "d766ceba695546af1140e850650d07d35970ddf1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "91753b6c4a1248d115434bb69d6211d1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5079,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd$W\u0018\ufffd\u8cba\b\ufffd\ufffd\ufffd\u04c1W^z\u0012uggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\b\ufffd\ufffd\u0013\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd$W\u0018\ufffd\u8cba\b\ufffd\ufffd\ufffd\u04c1W^z\u0012uggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\b\ufffd\ufffd\u0013\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd2x\ufffd\ufffd{G\u0003\ufffd\ufffd\ufffdT\ufffd$\ufffdK\ufffdI\ufffd%}\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd$W\u0018\ufffd\u8cba\b\ufffd\ufffd\ufffd\u04c1W^z\u0012uggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\b\ufffd\ufffd\u0013\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9131e180b86e2eec68b359e3c3ed489250d5745",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd$W\u0018\ufffd\u8cba\b\ufffd\ufffd\ufffd\u04c1W^z\u0012uggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\b\ufffd\ufffd\u0013\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5079,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd$W\ufffd\u8cba\ufffd\ufffd\ufffd\u04c1W^zuggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\ufffd\ufffd\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5079 \u00b7 (reconnaissance)",
"target_port_label": "5079 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5079,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd$W\u0018\ufffd\u8cba\b\ufffd\ufffd\ufffd\u04c1W^z\u0012uggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\b\ufffd\ufffd\u0013\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5079,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5079 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd$W\ufffd\u8cba\ufffd\ufffd\ufffd\u04c1W^zuggpU\ufffd\ufffdd\ufffdx\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd1\ufffd8\ufffd1T\ufffd\ufffd\t\ufffd\ufffd?\r!\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\u9a50\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5079 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5079"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 33,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 33,
"scan_velocity_ports_per_s": 136.11,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5098 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5098 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5098
Chemin / cible
—
Service
TLS
Payload
� ��Y�i�q�6�zt����_C-T�N�{ά=�Uc lŎ �u����i�~gn�!7�^y�)�&�W)�q� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Y�i�q�6�zt����_C-T�N�{ά=�Uc lŎ �u����i�~gn�!7�^y�)�&�W)�q� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��Y�i�q�6�zt����_C-T�N�{ά=�Uc lŎ �u����i�~gn�!7�^y�)�&�W)�q� �+�/�,�0̨̩� �� � _ � � 2 + 3����̩���l=s���=x���R0I�P
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.6981657432279835,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5098,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "274903da94af36fd6d2462534462f18782255e29",
"event_fingerprint": "e5b9ce0130113f7d8363f472152e008260a584a3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "55c6b8504d1ca9d1ae09c257c641f97b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5098,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdY\ufffd\u0014i\ufffdq\u001a\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\u001e\ufffdu\ufffd\ufffd\ufffd\b\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdY\ufffd\u0014i\ufffdq\u001a\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\u001e\ufffdu\ufffd\ufffd\ufffd\b\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0001\u0007\u0329\ufffd\ufffd\ufffdl=s\ufffd\ufffd\ufffd=x\ufffd\ufffd\ufffdR0I\ufffdP\n",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdY\ufffd\u0014i\ufffdq\u001a\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\u001e\ufffdu\ufffd\ufffd\ufffd\b\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2b43652ee5e807d7dcc878abdd92a93f7c23d34",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdY\ufffd\u0014i\ufffdq\u001a\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\u001e\ufffdu\ufffd\ufffd\ufffd\b\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5098,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdY\ufffdi\ufffdq\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\ufffdu\ufffd\ufffd\ufffd\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5098 \u00b7 (reconnaissance)",
"target_port_label": "5098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdY\ufffd\u0014i\ufffdq\u001a\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\u001e\ufffdu\ufffd\ufffd\ufffd\b\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5098,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5098 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdY\ufffdi\ufffdq\ufffd6\ufffdzt\ufffd\ufffd\ufffd\ufffd_C-T\ufffdN\ufffd{\u03ac=\ufffdUc l\u014e\ufffdu\ufffd\ufffd\ufffd\ufffdi\ufffd~gn\ufffd!7\ufffd^y\ufffd)\ufffd&\ufffdW)\ufffdq\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 34,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 34,
"scan_velocity_ports_per_s": 136.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
15060 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15060 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15060
Chemin / cible
—
Service
TLS
Payload
� �+�) A2����ia��ngw��� ��+ vo A�� �P�����H�Q��"��G^�n.4�"� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+�) A2����ia��ngw��� ��+ vo A��
�P�����H�Q��"��G^�n.4�"� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �+�) A2����ia��ngw��� ��+ vo A�� �P�����H�Q��"��G^�n.4�"� �+�/�,�0̨̩� �� � _ � � 2 + 3���� 8�cѥ��L'G�pvDzy%��t6)�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.716423719799077,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15060,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1a7b5a4d893275498091d7237a2a5ca766d1b85b",
"event_fingerprint": "725a618d44b9dbe9526057ac27acba727008ff97",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "012dffdd43173b838d873701ddfa8b9a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15060,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003+\ufffd\u0530)\u000b\u0017A2\u0014\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+\u001ev\u0003o \u0011A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\u0006\"\ufffd\u0001\ufffdG^\ufffdn.4\u0007\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003+\ufffd\u0530)\u000b\u0017A2\u0014\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+\u001ev\u0003o \u0011A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\u0006\"\ufffd\u0001\ufffdG^\ufffdn.4\u0007\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd 8\ufffdc\u0465\ufffd\ufffdL'G\ufffdpv\u01f2y%\ufffd\ufffdt6\u0014)\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003+\ufffd\u0530)\u000b\u0017A2\u0014\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+\u001ev\u0003o \u0011A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\u0006\"\ufffd\u0001\ufffdG^\ufffdn.4\u0007\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91f2e4eeffaea9ab245363c59a335091e7c87c14",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003+\ufffd\u0530)\u000b\u0017A2\u0014\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+\u001ev\u0003o \u0011A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\u0006\"\ufffd\u0001\ufffdG^\ufffdn.4\u0007\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15060,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd+\ufffd\u0530)A2\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+vo A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\"\ufffd\ufffdG^\ufffdn.4\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15060 \u00b7 (reconnaissance)",
"target_port_label": "15060 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15060,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003+\ufffd\u0530)\u000b\u0017A2\u0014\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+\u001ev\u0003o \u0011A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\u0006\"\ufffd\u0001\ufffdG^\ufffdn.4\u0007\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15060,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15060 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd+\ufffd\u0530)A2\ufffd\ufffd\ufffd\ufffdia\ufffd\ufffdngw\ufffd\ufffd\ufffd\t\ufffd\ufffd+vo A\ufffd\ufffd\n\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffdQ\ufffd\ufffd\"\ufffd\ufffdG^\ufffdn.4\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15060 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 35,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 35,
"scan_velocity_ports_per_s": 136.68,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
15064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15064
Chemin / cible
—
Service
TLS
Payload
� �G�����ߪ��㚙�;���)�d�e����O�� &���+ ���^$V��g�c9��#��� �RN �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �G�����ߪ��㚙�;���)�d�e����O�� &���+ ���^$V��g�c9��#��� �RN �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �G�����ߪ��㚙�;���)�d�e����O�� &���+ ���^$V��g�c9��#��� �RN �+�/�,�0̨̩� �� � _ � � 2 + 3�����TU�:�ٹq��\Idhe�2��+�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.716557225825051,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9b5b66b774efb4416fc78da3b458f3c5a361f7eb",
"event_fingerprint": "3a14cc6a84d43b8e611af6d98e584a07ae5c43cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "ae7a11b9d760a8b49e698918e32b6b2d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\u0000\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\u0017\ufffd\ufffd\ufffd\u001c\ufffd\u0012RN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\u0000\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\u0017\ufffd\ufffd\ufffd\u001c\ufffd\u0012RN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0003TU\ufffd:\ufffd\u0679q\ufffd\ufffd\u0013\\Idhe\ufffd2\ufffd\ufffd+\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\u0000\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\u0017\ufffd\ufffd\ufffd\u001c\ufffd\u0012RN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30ace40ed947ed970e126c395b479326010d0742",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\u0000\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\u0017\ufffd\ufffd\ufffd\u001c\ufffd\u0012RN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdRN\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15064 \u00b7 (reconnaissance)",
"target_port_label": "15064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\u0000\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\u0017\ufffd\ufffd\ufffd\u001c\ufffd\u0012RN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u07ea\ufffd\ufffd\u3699\ufffd;\ufffd\ufffd\ufffd)\ufffdd\ufffde\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd &\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd^$V\ufffd\ufffdg\ufffdc9\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdRN\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 36,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075,
5076
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 36,
"scan_velocity_ports_per_s": 137.06,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5002 · UPNP SSL
|
upnp-ssl
|
Scan de ports
port scan syn · via UPNP SSL:5002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-SSL
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5002
Chemin / cible
—
Service
UPNP SSL
Payload
� ���oH��� �K �|���V��1�ĕ�� T2 ej�Y�S`1>��� %Y�`] n3��t��W8@ �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���oH��� �K �|���V��1�ĕ�� T2 ej�Y�S`1>��� %Y�`] n3��t��W8@ �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���oH��� �K �|���V��1�ĕ�� T2 ej�Y�S`1>��� %Y�`] n3��t��W8@ �+�/�,�0̨̩� �� � _ � � 2 + 3�����z8ML�ϋIEW���Q��y�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f73736c20726561647920706f72743d353030320d0a",
"emulator_response_len": 39,
"bytes_in": 1483,
"payload_entropy": 7.734272193415835,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "upnp-ssl",
"app_proto": "upnp-ssl",
"asn": 23470,
"country": "HK",
"dst_port": 5002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "806a3cc9fd63d83947bc3a9bd24197c5d8b48f87",
"event_fingerprint": "53fadf606b44c884c4df48803df6a473a6fc160d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "upnp-ssl",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a6b4e43030aed4b6f3bd2a21d08079fd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5002,
"service": "upnp-ssl",
"service_name": "upnp-ssl",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdoH\ufffd\ufffd\ufffd\u001d\ufffdK\f\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd\u0011 T2 ej\ufffdY\ufffdS`1\u0001>\ufffd\ufffd\u0016\ufffd\u000b%\u0002Y\ufffd`]\u001en3\ufffd\ufffdt\ufffd\ufffdW8@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdoH\ufffd\ufffd\ufffd\u001d\ufffdK\f\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd\u0011 T2 ej\ufffdY\ufffdS`1\u0001>\ufffd\ufffd\u0016\ufffd\u000b%\u0002Y\ufffd`]\u001en3\ufffd\ufffdt\ufffd\ufffdW8@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001a\ufffdz8\u0001ML\ufffd\u03cbIEW\ufffd\ufffd\u0013\ufffdQ\ufffd\ufffdy\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdoH\ufffd\ufffd\ufffd\u001d\ufffdK\f\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd\u0011 T2 ej\ufffdY\ufffdS`1\u0001>\ufffd\ufffd\u0016\ufffd\u000b%\u0002Y\ufffd`]\u001en3\ufffd\ufffdt\ufffd\ufffdW8@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41c2a115fd8801e7a32ae92060cbf16c71c23eff",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdoH\ufffd\ufffd\ufffd\u001d\ufffdK\f\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd\u0011 T2 ej\ufffdY\ufffdS`1\u0001>\ufffd\ufffd\u0016\ufffd\u000b%\u0002Y\ufffd`]\u001en3\ufffd\ufffdt\ufffd\ufffdW8@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5002,
"service": "upnp-ssl",
"service_label_fr": "UPNP SSL"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdoH\ufffd\ufffd\ufffd\ufffdK\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd T2 ej\ufffdY\ufffdS`1>\ufffd\ufffd\ufffd%Y\ufffd`]n3\ufffd\ufffdt\ufffd\ufffdW8@\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via UPNP SSL:5002 \u00b7 (reconnaissance)",
"target_port_label": "5002 \u00b7 UPNP SSL",
"emulator_service": "upnp-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP SSL \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-ssl",
"service_label_fr": "UPNP SSL",
"dst_port": 5002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-ssl",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdoH\ufffd\ufffd\ufffd\u001d\ufffdK\f\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd\u0011 T2 ej\ufffdY\ufffdS`1\u0001>\ufffd\ufffd\u0016\ufffd\u000b%\u0002Y\ufffd`]\u001en3\ufffd\ufffdt\ufffd\ufffdW8@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5002,
"service": "upnp-ssl",
"service_label_fr": "UPNP SSL"
},
"attack_vector": "port scan syn \u00b7 via UPNP SSL:5002 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdoH\ufffd\ufffd\ufffd\ufffdK\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffd1\ufffd\u0115\ufffd\ufffd T2 ej\ufffdY\ufffdS`1>\ufffd\ufffd\ufffd%Y\ufffd`]n3\ufffd\ufffdt\ufffd\ufffdW8@\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5002 \u00b7 UPNP SSL",
"emulator_service": "upnp-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_ssl",
"service_banner": "honeypot-upnp-ssl",
"service_os": "linux",
"dst_port": "5002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 37,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 37,
"scan_velocity_ports_per_s": 137.37,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
15050 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15050 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15050
Chemin / cible
—
Service
TLS
Payload
� �yx��e=b1I}�W�316�����y�9�� 'ܑ�3�<o��j(��/܈�R.��K� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �yx��e=b1I}�W�316�����y�9�� 'ܑ�3�<o��j(��/܈�R.��K� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �yx��e=b1I}�W�316�����y�9�� 'ܑ�3�<o��j(��/܈�R.��K� �+�/�,�0̨̩� �� � _ � � 2 + 3������n�l�\Q"� �� �W�F{�p�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.741061855639304,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15050,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aa70215626c56dc9d79f3db28208b9245bb50062",
"event_fingerprint": "884d2d9dd9b7773b4b96f1d0ba9b785b470c429b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "14ec57f2a2c4195339dfe2499ee87dfb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15050,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003yx\ufffd\ufffde=b1I}\ufffdW\ufffd31\u0004\u00156\ufffd\ufffd\u0011\ufffd\ufffd\u0003\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd\u00053\ufffd<o\u0013\ufffd\ufffdj(\ufffd\ufffd\/\u0708\u0014\ufffdR.\ufffd\ufffdK\ufffd\u0010\u000f\u0000\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003yx\ufffd\ufffde=b1I}\ufffdW\ufffd31\u0004\u00156\ufffd\ufffd\u0011\ufffd\ufffd\u0003\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd\u00053\ufffd<o\u0013\ufffd\ufffdj(\ufffd\ufffd\/\u0708\u0014\ufffdR.\ufffd\ufffdK\ufffd\u0010\u000f\u0000\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdn\ufffd\u0013l\ufffd\\Q\"\ufffd \ufffd\ufffd\u0015\u001c\ufffd\u001bW\ufffdF{\ufffdp\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003yx\ufffd\ufffde=b1I}\ufffdW\ufffd31\u0004\u00156\ufffd\ufffd\u0011\ufffd\ufffd\u0003\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd\u00053\ufffd<o\u0013\ufffd\ufffdj(\ufffd\ufffd\/\u0708\u0014\ufffdR.\ufffd\ufffdK\ufffd\u0010\u000f\u0000\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "acc6caaa8b0947424d1b80911bd71ca924d8df43",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003yx\ufffd\ufffde=b1I}\ufffdW\ufffd31\u0004\u00156\ufffd\ufffd\u0011\ufffd\ufffd\u0003\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd\u00053\ufffd<o\u0013\ufffd\ufffdj(\ufffd\ufffd\/\u0708\u0014\ufffdR.\ufffd\ufffdK\ufffd\u0010\u000f\u0000\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15050,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdyx\ufffd\ufffde=b1I}\ufffdW\ufffd316\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd3\ufffd<o\ufffd\ufffdj(\ufffd\ufffd\/\u0708\ufffdR.\ufffd\ufffdK\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15050 \u00b7 (reconnaissance)",
"target_port_label": "15050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15050,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003yx\ufffd\ufffde=b1I}\ufffdW\ufffd31\u0004\u00156\ufffd\ufffd\u0011\ufffd\ufffd\u0003\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd\u00053\ufffd<o\u0013\ufffd\ufffdj(\ufffd\ufffd\/\u0708\u0014\ufffdR.\ufffd\ufffdK\ufffd\u0010\u000f\u0000\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15050,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15050 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdyx\ufffd\ufffde=b1I}\ufffdW\ufffd316\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd '\u0711\ufffd3\ufffd<o\ufffd\ufffdj(\ufffd\ufffd\/\u0708\ufffdR.\ufffd\ufffdK\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 38,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 38,
"scan_velocity_ports_per_s": 137.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5085 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5085 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5085
Chemin / cible
—
Service
TLS
Payload
� ���>+��M�|L� ǂ`Ҫ��iV� �z�= L��C�f@dn�E f�[��2_��L,^k�NI �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���>+��M�|L� ǂ`Ҫ��iV� �z�= L��C�f@dn�E
f�[��2_��L,^k�NI �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���>+��M�|L� ǂ`Ҫ��iV� �z�= L��C�f@dn�E f�[��2_��L,^k�NI �+�/�,�0̨̩� �� � _ � � 2 + 3���� �ɮ�I$���A��3�������
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.741667194727347,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5085,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "701017a08f2ce25e853e144b4d8f399df46d9c3c",
"event_fingerprint": "169830b18c147e1bc745c2b87fb893bc3541c8e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "a6c2612352cd7a79a44fd4d4f94a3054",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5085,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0018\ufffd\ufffd>+\ufffd\ufffdM\u0001\ufffd\u0013|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\u001c\ufffdz\ufffd= L\ufffd\ufffdC\u0005\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\u0018\u000e\ufffdL,^k\ufffdNI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0018\ufffd\ufffd>+\ufffd\ufffdM\u0001\ufffd\u0013|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\u001c\ufffdz\ufffd= L\ufffd\ufffdC\u0005\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\u0018\u000e\ufffdL,^k\ufffdNI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001c\ufffd\u026e\ufffdI$\ufffd\ufffd\u0005\ufffdA\ufffd\u0016\ufffd3\u0016\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0018\ufffd\ufffd>+\ufffd\ufffdM\u0001\ufffd\u0013|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\u001c\ufffdz\ufffd= L\ufffd\ufffdC\u0005\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\u0018\u000e\ufffdL,^k\ufffdNI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb4bcf5358f9f24d91a4b377788942a3b33494a0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0018\ufffd\ufffd>+\ufffd\ufffdM\u0001\ufffd\u0013|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\u001c\ufffdz\ufffd= L\ufffd\ufffdC\u0005\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\u0018\u000e\ufffdL,^k\ufffdNI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5085,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd>+\ufffd\ufffdM\ufffd|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\ufffdz\ufffd= L\ufffd\ufffdC\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\ufffdL,^k\ufffdNI\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5085 \u00b7 (reconnaissance)",
"target_port_label": "5085 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5085,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0018\ufffd\ufffd>+\ufffd\ufffdM\u0001\ufffd\u0013|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\u001c\ufffdz\ufffd= L\ufffd\ufffdC\u0005\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\u0018\u000e\ufffdL,^k\ufffdNI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5085,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5085 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd>+\ufffd\ufffdM\ufffd|L\ufffd \u01c2`\u04aa\ufffd\ufffdiV\ufffd\ufffdz\ufffd= L\ufffd\ufffdC\ufffdf@dn\ufffdE\nf\ufffd[\ufffd\ufffd2_\ufffd\ufffdL,^k\ufffdNI\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5085 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 39,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 39,
"scan_velocity_ports_per_s": 138.05,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5087 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5087 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5087
Chemin / cible
—
Service
TLS
Payload
� �#[p�y� `�]�m?Hc��ظ�l�,tE��np W% �*j�b@���I��o�{� �VǑzg>�x �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �#[p�y�
`�]�m?Hc��ظ�l�,tE��np W% �*j�b@���I��o�{� �VǑzg>�x �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �#[p�y� `�]�m?Hc��ظ�l�,tE��np W% �*j�b@���I��o�{� �VǑzg>�x �+�/�,�0̨̩� �� � _ � � 2 + 3������8d�J �^x |n�0 ���8j^UZ
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.747682086955217,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5087,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6bd468ab22bc51dc61ca634d1158fdc27b78b4b9",
"event_fingerprint": "abb142716104a67106eba1b322ea4794cb13272f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "e4c0046800eaa954497d29fd0d6cbe92",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5087,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?H\u0004c\ufffd\ufffd\u0638\ufffdl\u000f\ufffd,\u0005tE\ufffd\ufffdnp W%\u000b\ufffd\u0019*j\ufffdb@\ufffd\u0010\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\u0000\ufffdV\u01d1zg>\ufffd\u0017x\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?H\u0004c\ufffd\ufffd\u0638\ufffdl\u000f\ufffd,\u0005tE\ufffd\ufffdnp W%\u000b\ufffd\u0019*j\ufffdb@\ufffd\u0010\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\u0000\ufffdV\u01d1zg>\ufffd\u0017x\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd8d\ufffdJ\u0000\ufffd^x\f|n\ufffd0 \ufffd\ufffd\ufffd8j^UZ\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?H\u0004c\ufffd\ufffd\u0638\ufffdl\u000f\ufffd,\u0005tE\ufffd\ufffdnp W%\u000b\ufffd\u0019*j\ufffdb@\ufffd\u0010\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\u0000\ufffdV\u01d1zg>\ufffd\u0017x\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df4dd757087a2d5b8ce99c7f448fe1b28b4b9c37",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?H\u0004c\ufffd\ufffd\u0638\ufffdl\u000f\ufffd,\u0005tE\ufffd\ufffdnp W%\u000b\ufffd\u0019*j\ufffdb@\ufffd\u0010\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\u0000\ufffdV\u01d1zg>\ufffd\u0017x\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5087,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?Hc\ufffd\ufffd\u0638\ufffdl\ufffd,tE\ufffd\ufffdnp W%\ufffd*j\ufffdb@\ufffd\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\ufffdV\u01d1zg>\ufffdx\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5087 \u00b7 (reconnaissance)",
"target_port_label": "5087 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5087,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?H\u0004c\ufffd\ufffd\u0638\ufffdl\u000f\ufffd,\u0005tE\ufffd\ufffdnp W%\u000b\ufffd\u0019*j\ufffdb@\ufffd\u0010\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\u0000\ufffdV\u01d1zg>\ufffd\u0017x\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5087,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5087 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd#[p\ufffdy\ufffd\r`\ufffd]\ufffdm?Hc\ufffd\ufffd\u0638\ufffdl\ufffd,tE\ufffd\ufffdnp W%\ufffd*j\ufffdb@\ufffd\ufffd\ufffdI\ufffd\ufffdo\ufffd{\ufffd\ufffdV\u01d1zg>\ufffdx\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5087 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 40,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 40,
"scan_velocity_ports_per_s": 138.46,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5092 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5092 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5092
Chemin / cible
—
Service
TLS
Payload
� ��M�K�u��%ƒy������%W�m�MאfP !�����[�We z,�3�ޖ"7ڰJ�R-c�H� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��M�K�u��%ƒy������%W�m�MאfP !�����[�We z,�3�ޖ"7ڰJ�R-c�H� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��M�K�u��%ƒy������%W�m�MאfP !�����[�We z,�3�ޖ"7ڰJ�R-c�H� �+�/�,�0̨̩� �� � _ � � 2 + 3�����l)z[~�i��+R�*Pz��t� O�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.712063630375077,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5092,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4129a4599c48de6c427006a76005e08fd9d110b0",
"event_fingerprint": "c64a0b47866317bb12c9c3305ecabc6497bfe9a3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "c98256b702923d80b0e3fc5f51ce9b0d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5092,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd%W\ufffdm\ufffdM\u05d0\u0006fP !\ufffd\ufffd\ufffd\u0002\ufffd\ufffd[\ufffdWe\u001ez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-\u0002c\ufffdH\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd%W\ufffdm\ufffdM\u05d0\u0006fP !\ufffd\ufffd\ufffd\u0002\ufffd\ufffd[\ufffdWe\u001ez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-\u0002c\ufffdH\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdl)z[~\ufffdi\u0016\ufffd\ufffd+R\ufffd*\u001aPz\ufffd\ufffdt\ufffd\u000bO\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd%W\ufffdm\ufffdM\u05d0\u0006fP !\ufffd\ufffd\ufffd\u0002\ufffd\ufffd[\ufffdWe\u001ez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-\u0002c\ufffdH\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4af2aa5acd1afe9820fdb6a216e731af8a0cdfe",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd%W\ufffdm\ufffdM\u05d0\u0006fP !\ufffd\ufffd\ufffd\u0002\ufffd\ufffd[\ufffdWe\u001ez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-\u0002c\ufffdH\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%W\ufffdm\ufffdM\u05d0fP !\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdWez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-c\ufffdH\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5092 \u00b7 (reconnaissance)",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5092,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd%W\ufffdm\ufffdM\u05d0\u0006fP !\ufffd\ufffd\ufffd\u0002\ufffd\ufffd[\ufffdWe\u001ez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-\u0002c\ufffdH\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5092 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdM\ufffdK\ufffdu\ufffd\ufffd%\u0192y\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%W\ufffdm\ufffdM\u05d0fP !\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdWez,\ufffd3\ufffd\u0796\"7\u06b0J\ufffdR-c\ufffdH\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 41,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 41,
"scan_velocity_ports_per_s": 138.89,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5081 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5081 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5081
Chemin / cible
—
Service
TLS
Payload
� �k�A� ���2b�z mN�|j� �Ȅ+���SHh �6�P���B��P�������#��� ����z� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �k�A� ���2b�z mN�|j�
�Ȅ+���SHh �6�P���B��P�������#���
����z� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �k�A� ���2b�z mN�|j� �Ȅ+���SHh �6�P���B��P�������#��� ����z� �+�/�,�0̨̩� �� � _ � � 2 + 3����<��r�r@/f ����!eB�W���
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.738302490951005,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c8621467d57e17cf4b9d7e972d339c019fe3a450",
"event_fingerprint": "4644edce4de1b93f727a7c8730768c9faa795b8b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "a1f1c2950ff67e860cb9170c2418a435",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5081,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003k\ufffdA\ufffd\f\ufffd\ufffd\ufffd2b\ufffdz\u001dmN\ufffd|j\ufffd\r\ufffd\u0204\u0015+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\u0016\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd#\ufffd\u001a\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003k\ufffdA\ufffd\f\ufffd\ufffd\ufffd2b\ufffdz\u001dmN\ufffd|j\ufffd\r\ufffd\u0204\u0015+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\u0016\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd#\ufffd\u001a\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0018<\ufffd\ufffdr\ufffdr@\/f\t\ufffd\ufffd\ufffd\ufffd\u000f\u0012!eB\ufffdW\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003k\ufffdA\ufffd\f\ufffd\ufffd\ufffd2b\ufffdz\u001dmN\ufffd|j\ufffd\r\ufffd\u0204\u0015+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\u0016\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd#\ufffd\u001a\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "830e4bee2875166133053b87e2fd0d204c5301f7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003k\ufffdA\ufffd\f\ufffd\ufffd\ufffd2b\ufffdz\u001dmN\ufffd|j\ufffd\r\ufffd\u0204\u0015+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\u0016\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd#\ufffd\u001a\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdk\ufffdA\ufffd\ufffd\ufffd\ufffd2b\ufffdzmN\ufffd|j\ufffd\r\ufffd\u0204+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5081 \u00b7 (reconnaissance)",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003k\ufffdA\ufffd\f\ufffd\ufffd\ufffd2b\ufffdz\u001dmN\ufffd|j\ufffd\r\ufffd\u0204\u0015+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\u0016\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd#\ufffd\u001a\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5081 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdk\ufffdA\ufffd\ufffd\ufffd\ufffd2b\ufffdzmN\ufffd|j\ufffd\r\ufffd\u0204+\ufffd\ufffd\ufffdSHh \ufffd6\ufffdP\ufffd\ufffd\ufffdB\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 42,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 42,
"scan_velocity_ports_per_s": 139.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5082 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5082 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5082
Chemin / cible
—
Service
TLS
Payload
� ���P�T��kKx��q ��б&p�¹nƳ-@� �3>q�k�W���=M.��0�����(���V& �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���P�T��kKx��q ��б&p�¹nƳ-@� �3>q�k�W���=M.��0�����(���V& �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���P�T��kKx��q ��б&p�¹nƳ-@� �3>q�k�W���=M.��0�����(���V& �+�/�,�0̨̩� �� � _ � � 2 + 3����X�2�P�GcJ�0O��e�Icסz���
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.709510668850455,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5082,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "404e687e7635fbb1ac8ac2c98cbd5f58d0ebe954",
"event_fingerprint": "669d47ec1b042c602f0212855e0d9c03c32e5258",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "dbeda0a0b74eb9467296373e8e8da8cc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5082,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdP\ufffd\u001bT\ufffd\ufffdkK\u0007x\ufffd\ufffdq \ufffd\ufffd\u0001\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\u000e\ufffd0\ufffd\ufffd\ufffd\ufffd\u0018\ufffd(\ufffd\ufffd\u001a\ufffd\u0007V&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdP\ufffd\u001bT\ufffd\ufffdkK\u0007x\ufffd\ufffdq \ufffd\ufffd\u0001\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\u000e\ufffd0\ufffd\ufffd\ufffd\ufffd\u0018\ufffd(\ufffd\ufffd\u001a\ufffd\u0007V&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdX\ufffd2\ufffdP\ufffdGcJ\ufffd0O\ufffd\ufffde\ufffd\u0003Ic\u05e1z\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdP\ufffd\u001bT\ufffd\ufffdkK\u0007x\ufffd\ufffdq \ufffd\ufffd\u0001\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\u000e\ufffd0\ufffd\ufffd\ufffd\ufffd\u0018\ufffd(\ufffd\ufffd\u001a\ufffd\u0007V&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a8d3446324fde30e35900e4cfac83abbe124a8b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdP\ufffd\u001bT\ufffd\ufffdkK\u0007x\ufffd\ufffdq \ufffd\ufffd\u0001\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\u000e\ufffd0\ufffd\ufffd\ufffd\ufffd\u0018\ufffd(\ufffd\ufffd\u001a\ufffd\u0007V&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5082,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdP\ufffdT\ufffd\ufffdkKx\ufffd\ufffdq \ufffd\ufffd\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffdV&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5082 \u00b7 (reconnaissance)",
"target_port_label": "5082 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5082,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdP\ufffd\u001bT\ufffd\ufffdkK\u0007x\ufffd\ufffdq \ufffd\ufffd\u0001\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\u000e\ufffd0\ufffd\ufffd\ufffd\ufffd\u0018\ufffd(\ufffd\ufffd\u001a\ufffd\u0007V&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5082,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5082 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdP\ufffdT\ufffd\ufffdkKx\ufffd\ufffdq \ufffd\ufffd\u0431&p\ufffd\u00b9n\u01b3-@\ufffd \ufffd3>q\ufffdk\ufffdW\ufffd\ufffd\ufffd=M.\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffdV&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5082 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 43,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 43,
"scan_velocity_ports_per_s": 139.66,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5093 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5093 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5093
Chemin / cible
—
Service
TLS
Payload
� ��Iˍ�6C�; I���2Yx$���'7p���{�} �I-b2����<�R������m�G�փ���.> �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Iˍ�6C�; I���2Yx$���'7p���{�} �I-b2����<�R������m�G�փ���.> �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��Iˍ�6C�; I���2Yx$���'7p���{�} �I-b2����<�R������m�G�փ���.> �+�/�,�0̨̩� �� � _ � � 2 + 3����#g���$�MU -���� �� ���
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7452869688835815,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5093,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6ac1c6a6c15d3eb23c85e1781efd3fa2790cedf9",
"event_fingerprint": "e1523cd580c7ca152620e644d6fb05151c0b1c97",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "5881a5d2cb2aa3e1625a0b212296465c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5093,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdI\u02cd\ufffd6C\ufffd;\u0000I\ufffd\ufffd\ufffd2Yx$\u000e\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \u0013\ufffdI-b\u00162\u0014\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdI\u02cd\ufffd6C\ufffd;\u0000I\ufffd\ufffd\ufffd2Yx$\u000e\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \u0013\ufffdI-b\u00162\u0014\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd#\u0017g\ufffd\ufffd\ufffd$\ufffdMU\u001c-\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\u001c\u0001\ufffd\ufffd\u0013\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdI\u02cd\ufffd6C\ufffd;\u0000I\ufffd\ufffd\ufffd2Yx$\u000e\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \u0013\ufffdI-b\u00162\u0014\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2b8b04c03041f19034002763d1414602dc33bc7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdI\u02cd\ufffd6C\ufffd;\u0000I\ufffd\ufffd\ufffd2Yx$\u000e\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \u0013\ufffdI-b\u00162\u0014\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdI\u02cd\ufffd6C\ufffd;I\ufffd\ufffd\ufffd2Yx$\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \ufffdI-b2\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5093 \u00b7 (reconnaissance)",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5093,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdI\u02cd\ufffd6C\ufffd;\u0000I\ufffd\ufffd\ufffd2Yx$\u000e\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \u0013\ufffdI-b\u00162\u0014\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5093 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdI\u02cd\ufffd6C\ufffd;I\ufffd\ufffd\ufffd2Yx$\ufffd\ufffd\ufffd'7p\ufffd\ufffd\ufffd{\ufffd} \ufffdI-b2\ufffd\ufffd\ufffd\ufffd<\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdG\ufffd\u0583\ufffd\ufffd\ufffd.>\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 44,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 44,
"scan_velocity_ports_per_s": 139.9,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
15063 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15063 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15063
Chemin / cible
—
Service
TLS
Payload
� ���sԎ�/�c�W/x���O!MsS��;'�{B� U]����$��-7���o���ѕ��5F��Hd �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���sԎ�/�c�W/x���O!MsS��;'�{B� U]����$��-7���o���ѕ��5F��Hd �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���sԎ�/�c�W/x���O!MsS��;'�{B� U]����$��-7���o���ѕ��5F��Hd �+�/�,�0̨̩� �� � _ � � 2 + 3����q7���0�b;~��+�x�w)5��x�y
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.721754119778822,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15063,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5f94fd29cb2440adb25dddbe0ffc015adedf3c32",
"event_fingerprint": "6bb76f33f228fcb6872beddff0a04f221c5774f8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "846e8e1ef3e33335883cb8e44418aea3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15063,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\u0017s\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffd\u001aO!\u0010MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\u001b\ufffd\u0004$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdH\u0001d\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\u0017s\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffd\u001aO!\u0010MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\u001b\ufffd\u0004$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdH\u0001d\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdq7\ufffd\ufffd\ufffd0\ufffdb;~\ufffd\ufffd+\ufffdx\ufffdw\u0001)5\ufffd\ufffdx\ufffdy",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\u0017s\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffd\u001aO!\u0010MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\u001b\ufffd\u0004$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdH\u0001d\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9cbe50cc90e14fefa8f392495adb29ff3b345a6b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\u0017s\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffd\u001aO!\u0010MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\u001b\ufffd\u0004$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdH\u0001d\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15063,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffds\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffdO!MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdHd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15063 \u00b7 (reconnaissance)",
"target_port_label": "15063 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15063,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\u0017s\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffd\u001aO!\u0010MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\u001b\ufffd\u0004$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdH\u0001d\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15063,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15063 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffds\u050e\ufffd\/\ufffdc\ufffdW\/x\ufffd\ufffd\ufffdO!MsS\ufffd\ufffd;'\ufffd{B\ufffd U]\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd-7\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u0455\ufffd\ufffd5F\ufffd\ufffdHd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15063 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15063"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 45,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 45,
"scan_velocity_ports_per_s": 140.15,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
7002 · WEBLOGIC SSL
|
weblogic-ssl
|
Scan de ports
port scan syn · via WEBLOGIC SSL:7002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
WEBLOGIC-SSL
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7002
Chemin / cible
—
Service
WEBLOGIC SSL
Payload
� �&�Z�6l���~���|�1��'H]k�ETb�I �%����Z��#�����w�Q ;]Q�B�,�a�w �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&�Z�6l���~���|�1��'H]k�ETb�I �%����Z��#�����w�Q ;]Q�B�,�a�w �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �&�Z�6l���~���|�1��'H]k�ETb�I �%����Z��#�����w�Q ;]Q�B�,�a�w �+�/�,�0̨̩� �� � _ � � 2 + 3�����D� ڜ�;�\�}\�b��E+�Bp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1483,
"payload_entropy": 7.704553335043404,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "weblogic-ssl",
"app_proto": "weblogic-ssl",
"asn": 23470,
"country": "HK",
"dst_port": 7002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "677011d3f6743f104300a7daba28f63d48af623e",
"event_fingerprint": "b88059c55131045bd5bcb4f75ad8e5083c7b678c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "weblogic-ssl",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a4af1072cd194548e3b1f9b39309c488",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7002,
"service": "weblogic-ssl",
"service_name": "weblogic-ssl",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd\u00101\ufffd\u0016\ufffd\u0016'H]k\ufffdET\u0011b\ufffdI \ufffd%\ufffd\ufffd\u0014\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u0015Q\u001e;]Q\ufffdB\ufffd,\ufffda\ufffdw\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd\u00101\ufffd\u0016\ufffd\u0016'H]k\ufffdET\u0011b\ufffdI \ufffd%\ufffd\ufffd\u0014\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u0015Q\u001e;]Q\ufffdB\ufffd,\ufffda\ufffdw\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdD\ufffd\u001f\u069c\ufffd\u0005;\ufffd\\\ufffd}\\\ufffdb\ufffd\ufffd\u0382E+\ufffdBp",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd\u00101\ufffd\u0016\ufffd\u0016'H]k\ufffdET\u0011b\ufffdI \ufffd%\ufffd\ufffd\u0014\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u0015Q\u001e;]Q\ufffdB\ufffd,\ufffda\ufffdw\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86adfbca3c33424b02ebbab28ca9c80c7d621a5c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd\u00101\ufffd\u0016\ufffd\u0016'H]k\ufffdET\u0011b\ufffdI \ufffd%\ufffd\ufffd\u0014\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u0015Q\u001e;]Q\ufffdB\ufffd,\ufffda\ufffdw\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7002,
"service": "weblogic-ssl",
"service_label_fr": "WEBLOGIC SSL"
},
"evidence_snippet": "\ufffd\ufffd&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd1\ufffd\ufffd'H]k\ufffdETb\ufffdI \ufffd%\ufffd\ufffd\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdQ;]Q\ufffdB\ufffd,\ufffda\ufffdw\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via WEBLOGIC SSL:7002 \u00b7 (reconnaissance)",
"target_port_label": "7002 \u00b7 WEBLOGIC SSL",
"emulator_service": "weblogic-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBLOGIC SSL \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "weblogic-ssl",
"service_label_fr": "WEBLOGIC SSL",
"dst_port": 7002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-ssl",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd\u00101\ufffd\u0016\ufffd\u0016'H]k\ufffdET\u0011b\ufffdI \ufffd%\ufffd\ufffd\u0014\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u0015Q\u001e;]Q\ufffdB\ufffd,\ufffda\ufffdw\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7002,
"service": "weblogic-ssl",
"service_label_fr": "WEBLOGIC SSL"
},
"attack_vector": "port scan syn \u00b7 via WEBLOGIC SSL:7002 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd&\ufffdZ\ufffd6l\ufffd\ufffd\ufffd~\ufffd\ufffd\ufffd|\ufffd1\ufffd\ufffd'H]k\ufffdETb\ufffdI \ufffd%\ufffd\ufffd\ufffd\ufffdZ\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdQ;]Q\ufffdB\ufffd,\ufffda\ufffdw\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "7002 \u00b7 WEBLOGIC SSL",
"emulator_service": "weblogic-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_ssl",
"service_banner": "honeypot-weblogic-ssl",
"service_os": "linux",
"dst_port": "7002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 46,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 46,
"scan_velocity_ports_per_s": 140.46,
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
15065 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15065 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15065
Chemin / cible
—
Service
TLS
Payload
� ��U��E�oA�#�J//�4�3�[�З�tI=K �y[MH L͈���ap9�芊�AR���!M�:� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��U��E�oA�#�J//�4�3�[�З�tI=K �y[MH L͈���ap9�芊�AR���!M�:� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��U��E�oA�#�J//�4�3�[�З�tI=K �y[MH L͈���ap9�芊�AR���!M�:� �+�/�,�0̨̩� �� � _ � � 2 + 3���� �9V;��ʔ?R��îd4�j'`�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.737712976726201,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15065,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "69a2aac4ebb8a2adf985641486d4a1a359158f72",
"event_fingerprint": "4862d08c1e31152f120b25e962210e6d6354a05a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0103",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "fcf332744c7c59c3cb48d84509617f96",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15065,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdU\u0012\ufffd\ufffdE\ufffdoA\u0007\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\u000f\b\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MH\u001eL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\u000f\u0015\ufffd\ufffd!M\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdU\u0012\ufffd\ufffdE\ufffdoA\u0007\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\u000f\b\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MH\u001eL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\u000f\u0015\ufffd\ufffd!M\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001f\ufffd9V;\u008e\ufffd\u0018\ufffd\u0294?R\ufffd\ufffd\u00eed4\ufffdj'`\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdU\u0012\ufffd\ufffdE\ufffdoA\u0007\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\u000f\b\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MH\u001eL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\u000f\u0015\ufffd\ufffd!M\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f880a5fc3bfc46021ea025cea92f5dc684921659",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdU\u0012\ufffd\ufffdE\ufffdoA\u0007\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\u000f\b\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MH\u001eL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\u000f\u0015\ufffd\ufffd!M\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15065,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdU\ufffd\ufffdE\ufffdoA\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MHL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\ufffd\ufffd!M\ufffd:\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15065 \u00b7 (reconnaissance)",
"target_port_label": "15065 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15065,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdU\u0012\ufffd\ufffdE\ufffdoA\u0007\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\u000f\b\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MH\u001eL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\u000f\u0015\ufffd\ufffd!M\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15065,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15065 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdU\ufffd\ufffdE\ufffdoA\ufffd#\ufffdJ\/\/\ufffd4\ufffd3\ufffd[\ufffd\u0417\ufffdtI=K \ufffdy[MHL\u0348\ufffd\ufffd\ufffdap9\ufffd\u828a\ufffdAR\ufffd\ufffd\ufffd!M\ufffd:\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15065 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 47,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 47,
"scan_velocity_ports_per_s": 140.78,
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"sip-tls",
"tls",
"upnp-ssl",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
Scan de ports
port scan syn · via ORACLE EM:7443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
oracle_em_emulated
oracle_em_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Service
ORACLE EM
Payload
� ��j�a�* {���N�7��+��Z�7镠 :���ԑI���� hAݳ3��� ��V~%v� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��j�a�* {���N�7��+��Z�7镠 :���ԑI���� hAݳ3��� ��V~%v� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��j�a�* {���N�7��+��Z�7镠 :���ԑI���� hAݳ3��� ��V~%v� �+�/�,�0̨̩� �� � _ � � 2 + 3������;kk���$2���H�&���:t�ô
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1483,
"payload_entropy": 7.742777209060298,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "oracle-em",
"app_proto": "oracle-em",
"asn": 23470,
"country": "HK",
"dst_port": 7443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "539a6724c438f1775cb9fea2c66ad114a117c409",
"event_fingerprint": "3ec7a95320670b1edf3d71dbb8f333993e7d03f8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "oracle-em",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7c878651bffcc0142c6ff124a212fc9d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7443,
"service": "oracle-em",
"service_name": "oracle-em",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdj\ufffda\ufffd*\u001c{\ufffd\ufffd\ufffd\u0010N\ufffd7\ufffd\ufffd\u0004\u000e+\ufffd\ufffd\bZ\u0019\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\t\u000ehA\u07733\ufffd\ufffd\u0012\ufffd\u001e\ufffd\ufffdV~%v\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdj\ufffda\ufffd*\u001c{\ufffd\ufffd\ufffd\u0010N\ufffd7\ufffd\ufffd\u0004\u000e+\ufffd\ufffd\bZ\u0019\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\t\u000ehA\u07733\ufffd\ufffd\u0012\ufffd\u001e\ufffd\ufffdV~%v\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd;k\u0015k\ufffd\ufffd\ufffd$2\ufffd\ufffd\ufffdH\ufffd&\ufffd\ufffd\ufffd:t\ufffd\u00f4",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdj\ufffda\ufffd*\u001c{\ufffd\ufffd\ufffd\u0010N\ufffd7\ufffd\ufffd\u0004\u000e+\ufffd\ufffd\bZ\u0019\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\t\u000ehA\u07733\ufffd\ufffd\u0012\ufffd\u001e\ufffd\ufffdV~%v\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7108a04b3f0d4c1def80b8c7cd1d908c77cac514",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdj\ufffda\ufffd*\u001c{\ufffd\ufffd\ufffd\u0010N\ufffd7\ufffd\ufffd\u0004\u000e+\ufffd\ufffd\bZ\u0019\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\t\u000ehA\u07733\ufffd\ufffd\u0012\ufffd\u001e\ufffd\ufffdV~%v\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffda\ufffd*{\ufffd\ufffd\ufffdN\ufffd7\ufffd\ufffd+\ufffd\ufffdZ\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\thA\u07733\ufffd\ufffd\ufffd\ufffd\ufffdV~%v\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ORACLE EM \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "oracle-em",
"service_label_fr": "ORACLE EM",
"dst_port": 7443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle-em",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdj\ufffda\ufffd*\u001c{\ufffd\ufffd\ufffd\u0010N\ufffd7\ufffd\ufffd\u0004\u000e+\ufffd\ufffd\bZ\u0019\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\t\u000ehA\u07733\ufffd\ufffd\u0012\ufffd\u001e\ufffd\ufffdV~%v\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "port scan syn \u00b7 via ORACLE EM:7443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffda\ufffd*{\ufffd\ufffd\ufffdN\ufffd7\ufffd\ufffd+\ufffd\ufffdZ\ufffd7\u9560 :\ufffd\ufffd\ufffd\u0511I\ufffd\ufffd\ufffd\ufffd\thA\u07733\ufffd\ufffd\ufffd\ufffd\ufffdV~%v\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle_em",
"service_banner": "honeypot-oracle-em",
"service_os": "linux",
"dst_port": "7443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 48,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 48,
"scan_velocity_ports_per_s": 141.13,
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"oracle_em_emulated",
"oracle_em_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
7001 · WEBLOGIC
|
weblogic
|
Scan de ports
port scan syn · via WEBLOGIC:7001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
� �����\�Tv���CNI�DQ� �%�])g��Z ���E��E��Q�گ���c6�W�� pb��k�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����\�Tv���CNI�DQ� �%�])g��Z ���E��E��Q�گ���c6�W�� pb��k�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �����\�Tv���CNI�DQ� �%�])g��Z ���E��E��Q�گ���c6�W�� pb��k�� �+�/�,�0̨̩� �� � _ � � 2 + 3�����D�8�a�a��Cs;�c�o����@U?
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 1483,
"payload_entropy": 7.727099624649839,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 23470,
"country": "HK",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "776d7acf14d18e84c691ce40eff386dca79bc8df",
"event_fingerprint": "6f7c2121a7e056fb57bd2523bd43bf2060a47b5e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1e8d669191702ac75e4f438c4c80d312",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\\\ufffd\u0005Tv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffd\u000e\u000bpb\ufffd\ufffdk\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\\\ufffd\u0005Tv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffd\u000e\u000bpb\ufffd\ufffdk\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdD\ufffd8\ufffda\ufffda\ufffd\ufffdC\bs;\ufffdc\ufffdo\ufffd\ufffd\ufffd\ufffd@U?",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\\\ufffd\u0005Tv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffd\u000e\u000bpb\ufffd\ufffdk\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "02b1a9c738bb04bbfa84a249f9796ef38b155d12",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\\\ufffd\u0005Tv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffd\u000e\u000bpb\ufffd\ufffdk\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdTv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffdpb\ufffd\ufffdk\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via WEBLOGIC:7001 \u00b7 (reconnaissance)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBLOGIC \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\\\ufffd\u0005Tv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffd\u000e\u000bpb\ufffd\ufffdk\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "port scan syn \u00b7 via WEBLOGIC:7001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdTv\ufffd\ufffd\ufffdCN\u176dI\ufffdDQ\ufffd \ufffd%\ufffd])g\ufffd\ufffdZ \ufffd\ufffd\ufffdE\ufffd\ufffdE\ufffd\ufffdQ\ufffd\u06af\ufffd\ufffd\ufffdc6\ufffdW\ufffd\ufffdpb\ufffd\ufffdk\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 49,
"port_scan_ports_sample": [
5002,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 49,
"scan_velocity_ports_per_s": 141.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello",
"weblogic_emulated"
]
}
|
|
|
TCP |
5059 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5059 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5059
Chemin / cible
—
Service
TLS
Payload
� �M �cڂ5����}����0)�kz���,���� c�9�^^g@��X�?�9m��p aAྕ��L �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �M �cڂ5����}����0)�kz���,���� c�9�^^g@��X�?�9m��p aAྕ��L �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �M �cڂ5����}����0)�kz���,���� c�9�^^g@��X�?�9m��p aAྕ��L �+�/�,�0̨̩� �� � _ � � 2 + 3����������Pkj?� �˺��j� �v
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.763669801900003,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5059,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57eb45f2f9931a610a6b234236aaba89cfc0dbdd",
"event_fingerprint": "739319633e693644ecb132f069107cf8d2d2f7ab",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "6f641d5064cd200b92acc9f0ebf5f70a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5059,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003M\t\u0002\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\u0002\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^\u0019^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091\u000baA\u0f95\ufffd\ufffdL\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003M\t\u0002\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\u0002\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^\u0019^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091\u000baA\u0f95\ufffd\ufffdL\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdPkj?\ufffd\t\ufffd\u02fa\ufffd\ufffdj\ufffd\u000b\u0000\ufffd\u001b\u0011v",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003M\t\u0002\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\u0002\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^\u0019^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091\u000baA\u0f95\ufffd\ufffdL\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2acefb8c841c12fd97b9ef79a303131849bcb6bc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003M\t\u0002\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\u0002\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^\u0019^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091\u000baA\u0f95\ufffd\ufffdL\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5059,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdM\t\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091aA\u0f95\ufffd\ufffdL\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5059 \u00b7 (reconnaissance)",
"target_port_label": "5059 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5059,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003M\t\u0002\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\u0002\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^\u0019^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091\u000baA\u0f95\ufffd\ufffdL\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5059,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5059 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdM\t\ufffdc\u06825\ufffd\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd0)\ufffdkz\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd c\ufffd9\ufffd^^g@\ufffd\ufffdX\ufffd?\ufffd9m\ufffd\ufffdp\u0091aA\u0f95\ufffd\ufffdL\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5059 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5059"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 50,
"port_scan_ports_sample": [
5002,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 50,
"scan_velocity_ports_per_s": 141.7,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5058 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5058 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5058
Chemin / cible
—
Service
TLS
Payload
� ��]�̚���k����HT��&�b:"Q�q~ �W�?)�/G3\^V�g~c��SZB�Qw��N�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��]�̚���k����HT��&�b:"Q�q~ �W�?)�/G3\^V�g~c��SZB�Qw��N�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��]�̚���k����HT��&�b:"Q�q~ �W�?)�/G3\^V�g~c��SZB�Qw��N�� �+�/�,�0̨̩� �� � _ � � 2 + 3����[<��� j� ��ol�6 %K��0�r
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7340206932894855,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5058,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "11558843ef19ffc37d768d0367ff0587e64d2234",
"event_fingerprint": "d0e7d6167e30259e9bf408595292261857b34a3f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "bbb82e3bded0db329d24456ad6b7c53a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5058,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdH\u0010T\b\ufffd\ufffd\u0014&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZ\u0012B\ufffdQw\ufffd\ufffdN\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdH\u0010T\b\ufffd\ufffd\u0014&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZ\u0012B\ufffdQw\ufffd\ufffdN\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd[<\ufffd\ufffd\ufffd\fj\ufffd\u001d\ufffd\ufffdol\ufffd6\u001c%K\ufffd\ufffd0\u0013\u0011\ufffdr",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdH\u0010T\b\ufffd\ufffd\u0014&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZ\u0012B\ufffdQw\ufffd\ufffdN\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e37c9dce666a4daa6410ef167cde7f2a5d05b33",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdH\u0010T\b\ufffd\ufffd\u0014&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZ\u0012B\ufffdQw\ufffd\ufffdN\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5058,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdHT\ufffd\ufffd&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZB\ufffdQw\ufffd\ufffdN\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5058 \u00b7 (reconnaissance)",
"target_port_label": "5058 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5058,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdH\u0010T\b\ufffd\ufffd\u0014&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZ\u0012B\ufffdQw\ufffd\ufffdN\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5058,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5058 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u05cd\ufffd]\ufffd\u031a\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffdHT\ufffd\ufffd&\ufffdb:\"Q\ufffdq~ \ufffdW\ufffd?)\ufffd\/G3\\^V\ufffdg~c\ufffd\ufffdSZB\ufffdQw\ufffd\ufffdN\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5058 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5058"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 51,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 51,
"scan_velocity_ports_per_s": 141.94,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5114 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5114 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5114
Chemin / cible
—
Service
TLS
Payload
� �/L�I����6�3D���ը���������z ���N Ѱ˅4�Sg"!u���!�4�y(��M� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/L�I����6�3D���ը���������z ���N Ѱ˅4�Sg"!u���!�4�y(��M� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �/L�I����6�3D���ը���������z ���N Ѱ˅4�Sg"!u���!�4�y(��M� �+�/�,�0̨̩� �� � _ � � 2 + 3������Z�uC��eB�������ʞ�H�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7448380516841215,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5114,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "973c5357c8fd4ab01c8e93bfc9476d708ab7cc49",
"event_fingerprint": "340f3ce3805240e1395b9859eee3182e13d9ea5c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "0d8c62c2e0c8f033adbb455245be5542",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5114,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u0012\ufffd\ufffd\ufffd\ufffdz\u001a\u0004 \ufffd\ufffd\ufffdN\u0000\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd\u00144\ufffd\u0019y(\ufffd\ufffdM\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u0012\ufffd\ufffd\ufffd\ufffdz\u001a\u0004 \ufffd\ufffd\ufffdN\u0000\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd\u00144\ufffd\u0019y(\ufffd\ufffdM\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdZ\ufffduC\ufffd\ufffdeB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u029e\ufffd\u001aH\ufffd\u0006\u0002",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u0012\ufffd\ufffd\ufffd\ufffdz\u001a\u0004 \ufffd\ufffd\ufffdN\u0000\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd\u00144\ufffd\u0019y(\ufffd\ufffdM\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc11e0056750b112691fc6fa058382e44a4be618",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u0012\ufffd\ufffd\ufffd\ufffdz\u001a\u0004 \ufffd\ufffd\ufffdN\u0000\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd\u00144\ufffd\u0019y(\ufffd\ufffdM\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5114,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \ufffd\ufffd\ufffdN\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd4\ufffdy(\ufffd\ufffdM\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5114 \u00b7 (reconnaissance)",
"target_port_label": "5114 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5114,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\u0013\ufffd\u0012\ufffd\ufffd\ufffd\ufffdz\u001a\u0004 \ufffd\ufffd\ufffdN\u0000\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd\u00144\ufffd\u0019y(\ufffd\ufffdM\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5114,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5114 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\/L\ufffdI\ufffd\ufffd\ufffd\ufffd6\ufffd3D\ufffd\ufffd\ufffd\u0568\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \ufffd\ufffd\ufffdN\u0470\u02c54\ufffdSg\"!u\ufffd\ufffd\ufffd!\ufffd4\ufffdy(\ufffd\ufffdM\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5114 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5114"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 52,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 52,
"scan_velocity_ports_per_s": 142.2,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5113 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5113 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5113
Chemin / cible
—
Service
TLS
Payload
� �` ɶ�c"k���>�Ն���]��y0����a,: O�2u�p�Z��0��x��&�O�;�A��{�t[��X �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �`
ɶ�c"k���>�Ն���]��y0����a,: O�2u�p�Z��0��x��&�O�;�A��{�t[��X �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �` ɶ�c"k���>�Ն���]��y0����a,: O�2u�p�Z��0��x��&�O�;�A��{�t[��X �+�/�,�0̨̩� �� � _ � � 2 + 3����8�|���1�����C#�(~��q
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.723284026450293,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5113,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8167cb61b797dbf15edf91477c8fe64cdc8c73d1",
"event_fingerprint": "c00673e591f8e0d13acebff82205a916edc7e419",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "3a86b4b290f0102804464d9fdec607f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5113,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd\u0012>\ufffd\u0546\ufffd\ufffd\u0001\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd\u0012>\ufffd\u0546\ufffd\ufffd\u0001\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd8\u0018\ufffd|\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffdC\u0002#\ufffd(~\u0018\u000e\ufffd\ufffdq",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd\u0012>\ufffd\u0546\ufffd\ufffd\u0001\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b99518795398cfadedcf5fe7b558c350c15cb84",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd\u0012>\ufffd\u0546\ufffd\ufffd\u0001\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5113,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd>\ufffd\u0546\ufffd\ufffd\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5113 \u00b7 (reconnaissance)",
"target_port_label": "5113 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5113,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd\u0012>\ufffd\u0546\ufffd\ufffd\u0001\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5113,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5113 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd`\n\u0276\ufffdc\"k\ufffd\ufffd\ufffd>\ufffd\u0546\ufffd\ufffd\ufffd]\ufffd\ufffdy0\ufffd\ufffd\ufffd\ufffda,: O\ufffd2u\ufffdp\ufffdZ\ufffd\ufffd0\ufffd\ufffdx\ufffd\ufffd&\ufffdO\ufffd;\ufffdA\ufffd\ufffd{\ufffdt[\ufffd\ufffdX\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5113 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5113"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 53,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 53,
"scan_velocity_ports_per_s": 142.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5117 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5117 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5117
Chemin / cible
—
Service
TLS
Payload
� ����^�= ���$#`���F��� �Al/;� �c'#7�S�S&) �z���rᖞ!��t��P� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����^�= ���$#`���F��� �Al/;� �c'#7�S�S&) �z���rᖞ!��t��P� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ����^�= ���$#`���F��� �Al/;� �c'#7�S�S&) �z���rᖞ!��t��P� �+�/�,�0̨̩� �� � _ � � 2 + 3���� R�Ua� �n�k�xP � , _� e
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.72924799967335,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5117,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b14440be5989b0a8efe58f57a9fa3c0116c17795",
"event_fingerprint": "fe6e3419166b19e5e99d56463bb55c1e3be46252",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "b078288340a40df0b779fa3d23a612f3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5117,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd^\ufffd=\u001c\u0011\ufffd\u0019\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\u0002\ufffd\ufffd\u001d\ufffd\u001aAl\u0015\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\u000b\ufffdz\ufffd\ufffd\ufffdr\u0015\u159e!\ufffd\ufffdt\ufffd\u0004\ufffdP\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd^\ufffd=\u001c\u0011\ufffd\u0019\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\u0002\ufffd\ufffd\u001d\ufffd\u001aAl\u0015\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\u000b\ufffdz\ufffd\ufffd\ufffdr\u0015\u159e!\ufffd\ufffdt\ufffd\u0004\ufffdP\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001eR\ufffdUa\ufffd\u0000\ufffdn\ufffdk\ufffd\u0018xP\n\ufffd\u000b,\u0015\u001c_\ufffd\u000be",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd^\ufffd=\u001c\u0011\ufffd\u0019\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\u0002\ufffd\ufffd\u001d\ufffd\u001aAl\u0015\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\u000b\ufffdz\ufffd\ufffd\ufffdr\u0015\u159e!\ufffd\ufffdt\ufffd\u0004\ufffdP\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32d7c534f6fb0ad571d5024b1346282be655c49d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd^\ufffd=\u001c\u0011\ufffd\u0019\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\u0002\ufffd\ufffd\u001d\ufffd\u001aAl\u0015\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\u000b\ufffdz\ufffd\ufffd\ufffdr\u0015\u159e!\ufffd\ufffdt\ufffd\u0004\ufffdP\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5117,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd=\ufffd\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdAl\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\ufffdz\ufffd\ufffd\ufffdr\u159e!\ufffd\ufffdt\ufffd\ufffdP\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5117 \u00b7 (reconnaissance)",
"target_port_label": "5117 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5117,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd^\ufffd=\u001c\u0011\ufffd\u0019\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\u0002\ufffd\ufffd\u001d\ufffd\u001aAl\u0015\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\u000b\ufffdz\ufffd\ufffd\ufffdr\u0015\u159e!\ufffd\ufffdt\ufffd\u0004\ufffdP\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5117,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5117 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd=\ufffd\ufffd\ufffd$#`\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdAl\/;\ufffd \ufffdc'#7\ufffdS\ufffdS&)\ufffdz\ufffd\ufffd\ufffdr\u159e!\ufffd\ufffdt\ufffd\ufffdP\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5117 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5117"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 54,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 54,
"scan_velocity_ports_per_s": 142.68,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5112 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5112 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5112
Chemin / cible
—
Service
TLS
Payload
� �ҫDu�,�����K�I�3�lZ$� ���B0m�m � �7����q=��Ui��-"��D����Eon �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ҫDu�,�����K�I�3�lZ$� ���B0m�m � �7����q=��Ui��-"��D����Eon �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �ҫDu�,�����K�I�3�lZ$� ���B0m�m � �7����q=��Ui��-"��D����Eon �+�/�,�0̨̩� �� � _ � � 2 + 3������.7�{����4Jiz2 �]�_[
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.695947241366134,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5112,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ab6e2e474c89fcc59ffc3e5bd0d78c792d302093",
"event_fingerprint": "653e9ce21e615cadaf879711f5132818528ba54f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "612232fe42e2f1fed106f2f2f12e9494",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5112,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04abDu\ufffd,\ufffd\u0005\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\u000b\ufffd\ufffd\ufffdB0m\ufffd\u0017m \ufffd\f\u000f\ufffd7\ufffd\u0010\ufffd\u0006\ufffd\ufffdq=\ufffd\ufffd\u0015Ui\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04abDu\ufffd,\ufffd\u0005\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\u000b\ufffd\ufffd\ufffdB0m\ufffd\u0017m \ufffd\f\u000f\ufffd7\ufffd\u0010\ufffd\u0006\ufffd\ufffdq=\ufffd\ufffd\u0015Ui\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd.7\ufffd{\ufffd\ufffd\ufffd\ufffd4Jiz\u001b\u001b2\u0018\u000b\ufffd]\ufffd_[",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04abDu\ufffd,\ufffd\u0005\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\u000b\ufffd\ufffd\ufffdB0m\ufffd\u0017m \ufffd\f\u000f\ufffd7\ufffd\u0010\ufffd\u0006\ufffd\ufffdq=\ufffd\ufffd\u0015Ui\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ecc29aab271877c547fa721310278d84e612287",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04abDu\ufffd,\ufffd\u0005\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\u000b\ufffd\ufffd\ufffdB0m\ufffd\u0017m \ufffd\f\u000f\ufffd7\ufffd\u0010\ufffd\u0006\ufffd\ufffdq=\ufffd\ufffd\u0015Ui\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5112,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u04abDu\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\ufffd\ufffd\ufffdB0m\ufffdm \ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdq=\ufffd\ufffdUi\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5112 \u00b7 (reconnaissance)",
"target_port_label": "5112 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5112,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04abDu\ufffd,\ufffd\u0005\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\u000b\ufffd\ufffd\ufffdB0m\ufffd\u0017m \ufffd\f\u000f\ufffd7\ufffd\u0010\ufffd\u0006\ufffd\ufffdq=\ufffd\ufffd\u0015Ui\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5112,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5112 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u04abDu\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffdI\ufffd3\ufffdlZ$\ufffd\ufffd\ufffd\ufffdB0m\ufffdm \ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdq=\ufffd\ufffdUi\ufffd\ufffd-\"\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdEon\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5112 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 55,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 55,
"scan_velocity_ports_per_s": 142.88,
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
9002 · MINIO CONSOLE
|
minio-console
|
Scan de ports
port scan syn · via MINIO CONSOLE:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
MINIO-CONSOLE
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9002
Chemin / cible
—
Service
MINIO CONSOLE
Payload
� �E����|�0rU;?�˄����[�Q�^�45��� ���=$ZS�ߊ�MKS]6W���b�&���D �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �E����|�0rU;?�˄����[�Q�^�45��� ���=$ZS�ߊ�MKS]6W���b�&���D �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �E����|�0rU;?�˄����[�Q�^�45��� ���=$ZS�ߊ�MKS]6W���b�&���D �+�/�,�0̨̩� �� � _ � � 2 + 3���� �-, 蒹0����5ay���vH�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1483,
"payload_entropy": 7.709273266191783,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "minio-console",
"app_proto": "minio-console",
"asn": 23470,
"country": "HK",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "cb1a04b529a6678be1e7d97542c20c167de05e38",
"event_fingerprint": "1ecc4a8cf9348bc993033dc2db3257374f3e4996",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "minio-console",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b48bf15d995da808c7e59293a1fa74d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9002,
"service": "minio-console",
"service_name": "minio-console",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\u0018\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdM\u0011KS]6W\u0016\ufffd\ufffd\ufffdb\ufffd&\ufffd\u0006\ufffd\ufffdD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\u0018\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdM\u0011KS]6W\u0016\ufffd\ufffd\ufffdb\ufffd&\ufffd\u0006\ufffd\ufffdD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\n\ufffd-\u001a,\u001e\u84b90\ufffd\ufffd\ufffd\ufffd5ay\u001b\ufffd\ufffd\u0014\ufffdvH\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\u0018\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdM\u0011KS]6W\u0016\ufffd\ufffd\ufffdb\ufffd&\ufffd\u0006\ufffd\ufffdD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cd4a99449acdc708833e48d2165dde22c94d13f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\u0018\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdM\u0011KS]6W\u0016\ufffd\ufffd\ufffdb\ufffd&\ufffd\u0006\ufffd\ufffdD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"evidence_snippet": "\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdMKS]6W\ufffd\ufffd\ufffdb\ufffd&\ufffd\ufffd\ufffdD\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via MINIO CONSOLE:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MINIO CONSOLE \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "minio-console",
"service_label_fr": "MINIO CONSOLE",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minio-console",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\u0018\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdM\u0011KS]6W\u0016\ufffd\ufffd\ufffdb\ufffd&\ufffd\u0006\ufffd\ufffdD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "port scan syn \u00b7 via MINIO CONSOLE:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd|\ufffd0rU;?\ufffd\u02c4\ufffd\ufffd\ufffd\ufffd[\ufffdQ\ufffd^\ufffd45\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=$ZS\ufffd\u07ca\u05cb\ufffdMKS]6W\ufffd\ufffd\ufffdb\ufffd&\ufffd\ufffd\ufffdD\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minio_console",
"service_banner": "honeypot-minio-console",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 56,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 56,
"scan_velocity_ports_per_s": 143.13,
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
5116 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5116 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5116
Chemin / cible
—
Service
TLS
Payload
� �G�2����"VoE �Y��7{ ���� �Zv�] �E��� :8.�\{��P��vP��s c�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �G�2����"VoE �Y��7{ ���� �Zv�] �E��� :8.�\{��P��vP��s
c�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �G�2����"VoE �Y��7{ ���� �Zv�] �E��� :8.�\{��P��vP��s c�� �+�/�,�0̨̩� �� � _ � � 2 + 3������{Y�C�{I�a�� �V� ����
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.730871067711064,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5116,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1fd1c5152fd949ba5c876332836fb98a45bd0e88",
"event_fingerprint": "49946ca3f9ec6c0da12f35ee83d5f9ebf3e679d7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "34b3b9585fff8baace69182f2a6bbac5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5116,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\u001e\t\ufffdY\ufffd\ufffd7{\u000b\ufffd\ufffd\ufffd\u000f\ufffd\u001e\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:\u00128.\ufffd\\{\u0013\ufffd\ufffdP\ufffd\ufffd\u001bvP\ufffd\u0018\ufffds\nc\u0007\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\u001e\t\ufffdY\ufffd\ufffd7{\u000b\ufffd\ufffd\ufffd\u000f\ufffd\u001e\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:\u00128.\ufffd\\{\u0013\ufffd\ufffdP\ufffd\ufffd\u001bvP\ufffd\u0018\ufffds\nc\u0007\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0013\u0019\ufffd\ufffd{Y\ufffdC\ufffd{I\ufffda\ufffd\ufffd\t\ufffdV\ufffd \ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\u001e\t\ufffdY\ufffd\ufffd7{\u000b\ufffd\ufffd\ufffd\u000f\ufffd\u001e\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:\u00128.\ufffd\\{\u0013\ufffd\ufffdP\ufffd\ufffd\u001bvP\ufffd\u0018\ufffds\nc\u0007\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19e1e2b228d32390dac38438313326b5232b49f4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\u001e\t\ufffdY\ufffd\ufffd7{\u000b\ufffd\ufffd\ufffd\u000f\ufffd\u001e\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:\u00128.\ufffd\\{\u0013\ufffd\ufffdP\ufffd\ufffd\u001bvP\ufffd\u0018\ufffds\nc\u0007\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5116,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdG\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\t\ufffdY\ufffd\ufffd7{\ufffd\ufffd\ufffd\ufffd\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:8.\ufffd\\{\ufffd\ufffdP\ufffd\ufffdvP\ufffd\ufffds\nc\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5116 \u00b7 (reconnaissance)",
"target_port_label": "5116 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5116,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003G\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\u001e\t\ufffdY\ufffd\ufffd7{\u000b\ufffd\ufffd\ufffd\u000f\ufffd\u001e\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:\u00128.\ufffd\\{\u0013\ufffd\ufffdP\ufffd\ufffd\u001bvP\ufffd\u0018\ufffds\nc\u0007\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5116,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5116 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdG\ufffd2\ufffd\ufffd\ufffd\ufffd\"VoE\t\ufffdY\ufffd\ufffd7{\ufffd\ufffd\ufffd\ufffd\ufffdZv\ufffd] \ufffdE\ufffd\ufffd\ufffd\t:8.\ufffd\\{\ufffd\ufffdP\ufffd\ufffdvP\ufffd\ufffds\nc\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5116 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5116"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 57,
"port_scan_ports_sample": [
5002,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 57,
"scan_velocity_ports_per_s": 143.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5057 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5057 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5057
Chemin / cible
—
Service
TLS
Payload
� �%6��i�<� �m~��6 p�/&ONq ��/�} .F�^�̦�������>(�9x��i�F+29 �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �%6��i�<� �m~��6
p�/&ONq ��/�} .F�^�̦�������>(�9x��i�F+29 �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �%6��i�<� �m~��6 p�/&ONq ��/�} .F�^�̦�������>(�9x��i�F+29 �+�/�,�0̨̩� �� � _ � � 2 + 3����P+4��{ A�w�\k(��ͮ�)�Ao
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.70493570187559,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5057,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92f6d9cd618cbba6f652b84624027b17dce5411b",
"event_fingerprint": "8cdb215c2e508421ed6604478eb1b7033d1771f8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "9b8a433dd85cebfb5f01447e01cd7103",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5057,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003%6\ufffd\ufffdi\ufffd<\ufffd\u0004\u001f\ufffdm~\ufffd\ufffd6\rp\ufffd\/&O\u0018Nq\f\ufffd\ufffd\/\ufffd} .\u001aF\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\u0002\u0017\ufffd9x\ufffd\ufffdi\ufffdF+\u0013\u000529\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003%6\ufffd\ufffdi\ufffd<\ufffd\u0004\u001f\ufffdm~\ufffd\ufffd6\rp\ufffd\/&O\u0018Nq\f\ufffd\ufffd\/\ufffd} .\u001aF\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\u0002\u0017\ufffd9x\ufffd\ufffdi\ufffdF+\u0013\u000529\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdP+4\ufffd\ufffd{\u000bA\ufffdw\ufffd\\\bk(\ufffd\ufffd\u036e\ufffd)\ufffd\u0006Ao",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003%6\ufffd\ufffdi\ufffd<\ufffd\u0004\u001f\ufffdm~\ufffd\ufffd6\rp\ufffd\/&O\u0018Nq\f\ufffd\ufffd\/\ufffd} .\u001aF\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\u0002\u0017\ufffd9x\ufffd\ufffdi\ufffdF+\u0013\u000529\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b71bd0b92a16aa096c3ca9e1dc391ca08559f668",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003%6\ufffd\ufffdi\ufffd<\ufffd\u0004\u001f\ufffdm~\ufffd\ufffd6\rp\ufffd\/&O\u0018Nq\f\ufffd\ufffd\/\ufffd} .\u001aF\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\u0002\u0017\ufffd9x\ufffd\ufffdi\ufffdF+\u0013\u000529\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5057,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd%6\ufffd\ufffdi\ufffd<\ufffd\ufffdm~\ufffd\ufffd6\rp\ufffd\/&ONq\ufffd\ufffd\/\ufffd} .F\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\ufffd9x\ufffd\ufffdi\ufffdF+29\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5057 \u00b7 (reconnaissance)",
"target_port_label": "5057 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5057,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003%6\ufffd\ufffdi\ufffd<\ufffd\u0004\u001f\ufffdm~\ufffd\ufffd6\rp\ufffd\/&O\u0018Nq\f\ufffd\ufffd\/\ufffd} .\u001aF\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\u0002\u0017\ufffd9x\ufffd\ufffdi\ufffdF+\u0013\u000529\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5057,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5057 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd%6\ufffd\ufffdi\ufffd<\ufffd\ufffdm~\ufffd\ufffd6\rp\ufffd\/&ONq\ufffd\ufffd\/\ufffd} .F\ufffd^\ufffd\u0326\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>(\ufffd9x\ufffd\ufffdi\ufffdF+29\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5057 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5057"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 58,
"port_scan_ports_sample": [
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 58,
"scan_velocity_ports_per_s": 143.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5443 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5443
Chemin / cible
—
Service
TLS
Payload
� �$s����K�3͗�$�kq�J���5Na�"��E� �*v�лǨ��! G �*U\`;�Ñ��f^|& �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �$s����K�3͗�$�kq�J���5Na�"��E� �*v�лǨ��!
G
�*U\`;�Ñ��f^|& �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �$s����K�3͗�$�kq�J���5Na�"��E� �*v�лǨ��! G �*U\`;�Ñ��f^|& �+�/�,�0̨̩� �� � _ � � 2 + 3����8���&;�;�-����_���H�u
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.712297098934604,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "16ec57ac14f778f587d38a632538d3074805d208",
"event_fingerprint": "565e2cea2c0534de8aed90a4260f2f17a6d24a1f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "6fc7152b0600ee3f2972f048be46bea1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5443,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003$s\u0018\ufffd\ufffd\ufffd\u0002\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\u0017\ufffd\u0018\ufffdf^|&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003$s\u0018\ufffd\ufffd\ufffd\u0002\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\u0017\ufffd\u0018\ufffdf^|&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd8\ufffd\ufffd\ufffd&;\ufffd;\ufffd-\ufffd\ufffd\ufffd\ufffd_\ufffd\u0015\u0003\ufffd\ufffdH\ufffd\u0006\u001au",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003$s\u0018\ufffd\ufffd\ufffd\u0002\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\u0017\ufffd\u0018\ufffdf^|&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e4d002f46337d68f4aee8075fb65a9e53725a35",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003$s\u0018\ufffd\ufffd\ufffd\u0002\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\u0017\ufffd\u0018\ufffdf^|&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5443,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd$s\ufffd\ufffd\ufffd\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\ufffd\ufffdf^|&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5443 \u00b7 (reconnaissance)",
"target_port_label": "5443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5443,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003$s\u0018\ufffd\ufffd\ufffd\u0002\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\u0017\ufffd\u0018\ufffdf^|&\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5443,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5443 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd$s\ufffd\ufffd\ufffd\ufffdK\ufffd3\u0357\ufffd$\ufffdkq\ufffdJ\ufffd\ufffd\ufffd5Na\ufffd\"\ufffd\ufffdE\ufffd \ufffd*v\ufffd\u043b\u01e8\ufffd\ufffd!\rG\r\ufffd*U\\`;\ufffd\u00d1\ufffd\ufffdf^|&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5443 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 59,
"port_scan_ports_sample": [
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 59,
"scan_velocity_ports_per_s": 143.5,
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
� �����,a��ُ�[Qr@� ėA����]� !� ��'B������_b z��8vF�Z<hD �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����,a��ُ�[Qr@� ėA����]� !� ��'B������_b z��8vF�Z<hD �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �����,a��ُ�[Qr@� ėA����]� !� ��'B������_b z��8vF�Z<hD �+�/�,�0̨̩� �� � _ � � 2 + 3����=�e'�L |��a'�~�g��R�r�{�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 1483,
"payload_entropy": 7.739380507569895,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 23470,
"country": "HK",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3ca04d50a9dcc58a3e83455c7f13528df7a52497",
"event_fingerprint": "9e6806c5d201b773553fc6b2fc3ab265cff40d6c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d6993031c25e819c90dac8aed81f5aa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr\u0019@\ufffd\u0000\u0005\u0117A\ufffd\ufffd\ufffd\ufffd]\u001a\ufffd \t\u0019!\ufffd\u000b\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_b\u001fz\ufffd\ufffd8vF\ufffdZ<hD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr\u0019@\ufffd\u0000\u0005\u0117A\ufffd\ufffd\ufffd\ufffd]\u001a\ufffd \t\u0019!\ufffd\u000b\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_b\u001fz\ufffd\ufffd8vF\ufffdZ<hD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd=\ufffde'\ufffdL\t|\ufffd\ufffda\b'\ufffd~\ufffdg\ufffd\ufffdR\ufffdr\ufffd{\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr\u0019@\ufffd\u0000\u0005\u0117A\ufffd\ufffd\ufffd\ufffd]\u001a\ufffd \t\u0019!\ufffd\u000b\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_b\u001fz\ufffd\ufffd8vF\ufffdZ<hD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06064c9820bb2faeef0032b2d92412d71014eb9e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr\u0019@\ufffd\u0000\u0005\u0117A\ufffd\ufffd\ufffd\ufffd]\u001a\ufffd \t\u0019!\ufffd\u000b\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_b\u001fz\ufffd\ufffd8vF\ufffdZ<hD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr@\ufffd\u0117A\ufffd\ufffd\ufffd\ufffd]\ufffd \t!\ufffd\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_bz\ufffd\ufffd8vF\ufffdZ<hD\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr\u0019@\ufffd\u0000\u0005\u0117A\ufffd\ufffd\ufffd\ufffd]\u001a\ufffd \t\u0019!\ufffd\u000b\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_b\u001fz\ufffd\ufffd8vF\ufffdZ<hD\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,a\ufffd\ufffd\u064f\ufffd[Qr@\ufffd\u0117A\ufffd\ufffd\ufffd\ufffd]\ufffd \t!\ufffd\ufffd\ue654\ufffd'B\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_bz\ufffd\ufffd8vF\ufffdZ<hD\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 60,
"port_scan_ports_sample": [
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 60,
"scan_velocity_ports_per_s": 143.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
2001 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:2001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2001
Chemin / cible
—
Service
TLS
Payload
� �?�g�֛I��j[�p �l��< �'�e��0�� �&��)���u a2���8�����o VagmDW �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �?�g�֛I��j[�p �l��< �'�e��0�� �&��)���u a2���8�����o VagmDW �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �?�g�֛I��j[�p �l��< �'�e��0�� �&��)���u a2���8�����o VagmDW �+�/�,�0̨̩� �� � _ � � 2 + 3������ ,T{{��!��K?꒼�rc��ik
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7115019073543865,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 2001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "320782de6d69665438520a1cb7cbb8a9f2a21716",
"event_fingerprint": "2ed2bd353893db95078f3245c3e0ef22d6db36dc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "dfbc6857af0aa0b2f3dbe38cff1f5624",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2001,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\ufffdg\ufffd\u059bI\ufffd\ufffdj\u0004[\ufffd\u0005p\u000b\ufffdl\ufffd\ufffd<\b\u001c\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdu\u000ba2\ufffd\ufffd\ufffd\u00108\u000e\ufffd\ufffd\ufffd\ufffd\ufffdo\u0016\u001cVagmDW\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\ufffdg\ufffd\u059bI\ufffd\ufffdj\u0004[\ufffd\u0005p\u000b\ufffdl\ufffd\ufffd<\b\u001c\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdu\u000ba2\ufffd\ufffd\ufffd\u00108\u000e\ufffd\ufffd\ufffd\ufffd\ufffdo\u0016\u001cVagmDW\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u001f,T{{\ufffd\ufffd!\ufffd\u0006\ufffdK?\ua4bc\ufffdrc\ufffd\ufffdik",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\ufffdg\ufffd\u059bI\ufffd\ufffdj\u0004[\ufffd\u0005p\u000b\ufffdl\ufffd\ufffd<\b\u001c\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdu\u000ba2\ufffd\ufffd\ufffd\u00108\u000e\ufffd\ufffd\ufffd\ufffd\ufffdo\u0016\u001cVagmDW\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "244695f213adab89fe297558ecdee0fbda77b9fc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\ufffdg\ufffd\u059bI\ufffd\ufffdj\u0004[\ufffd\u0005p\u000b\ufffdl\ufffd\ufffd<\b\u001c\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdu\u000ba2\ufffd\ufffd\ufffd\u00108\u000e\ufffd\ufffd\ufffd\ufffd\ufffdo\u0016\u001cVagmDW\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 2001,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd?\ufffdg\ufffd\u059bI\ufffd\ufffdj[\ufffdp\ufffdl\ufffd\ufffd<\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdua2\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffdoVagmDW\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:2001 \u00b7 (reconnaissance)",
"target_port_label": "2001 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\ufffdg\ufffd\u059bI\ufffd\ufffdj\u0004[\ufffd\u0005p\u000b\ufffdl\ufffd\ufffd<\b\u001c\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdu\u000ba2\ufffd\ufffd\ufffd\u00108\u000e\ufffd\ufffd\ufffd\ufffd\ufffdo\u0016\u001cVagmDW\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 2001,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:2001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd?\ufffdg\ufffd\u059bI\ufffd\ufffdj[\ufffdp\ufffdl\ufffd\ufffd<\ufffd'\ufffde\ufffd\ufffd0\ufffd\ufffd \ufffd&\ufffd\ufffd)\ufffd\ufffd\ufffdua2\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffdoVagmDW\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "2001 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 61,
"port_scan_ports_sample": [
2001,
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 61,
"scan_velocity_ports_per_s": 143.72,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
15062 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:15062 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15062
Chemin / cible
—
Service
TLS
Payload
� ��W(qXr�*� �I����JG� ��T�F���� �ڶl��� ��= ��U)�77�܌�=�]� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��W(qXr�*�
�I����JG� ��T�F���� �ڶl���
��= ��U)�77�܌�=�]� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��W(qXr�*� �I����JG� ��T�F���� �ڶl��� ��= ��U)�77�܌�=�]� �+�/�,�0̨̩� �� � _ � � 2 + 3�����J�]�{xJj�m +a>!KZ%yg�'�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.721476768950873,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 15062,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6ee9297dcc38270404edcd7df31912944746752a",
"event_fingerprint": "7f400a3d687dd8f0de49d3ab261ea505cd37e2ae",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "9306e13f0778052c05c261a73b255727",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 15062,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\u0000\u000b\ufffd\ufffdT\ufffd\u0011\u0002F\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6\u0016l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\u001f\ufffd\u0010\ufffdU)\ufffd77\ufffd\u070c\ufffd\u0013=\ufffd]\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\u0000\u000b\ufffd\ufffdT\ufffd\u0011\u0002F\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6\u0016l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\u001f\ufffd\u0010\ufffdU)\ufffd77\ufffd\u070c\ufffd\u0013=\ufffd]\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdJ\ufffd]\ufffd{\u0013xJj\ufffdm\t+a>!KZ%yg\ufffd'\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\u0000\u000b\ufffd\ufffdT\ufffd\u0011\u0002F\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6\u0016l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\u001f\ufffd\u0010\ufffdU)\ufffd77\ufffd\u070c\ufffd\u0013=\ufffd]\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1a232e9e4a105d80ea26e4aa6d499e51d60bec1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\u0000\u000b\ufffd\ufffdT\ufffd\u0011\u0002F\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6\u0016l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\u001f\ufffd\u0010\ufffdU)\ufffd77\ufffd\u070c\ufffd\u0013=\ufffd]\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15062,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\ufffd\ufffdT\ufffdF\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\ufffd\ufffdU)\ufffd77\ufffd\u070c\ufffd=\ufffd]\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:15062 \u00b7 (reconnaissance)",
"target_port_label": "15062 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15062,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\u0000\u000b\ufffd\ufffdT\ufffd\u0011\u0002F\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6\u0016l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\u001f\ufffd\u0010\ufffdU)\ufffd77\ufffd\u070c\ufffd\u0013=\ufffd]\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 15062,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:15062 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdW(qXr\ufffd*\ufffd\n\ufffdI\ufffd\ufffd\ufffd\ufffdJG\ufffd\ufffd\ufffdT\ufffdF\ufffd\ufffd\ufffd\ufffd \ufffd\u06b6l\ufffd\ufffd\ufffd\n\ufffd\ufffd=\ufffd\ufffdU)\ufffd77\ufffd\u070c\ufffd=\ufffd]\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "15062 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15062"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 62,
"port_scan_ports_sample": [
2001,
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 62,
"scan_velocity_ports_per_s": 143.91,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
1001 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:1001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1001
Chemin / cible
—
Service
TLS
Payload
� �ʡ7��|�xku��gQf�d����98%�m��{� k6��o� ��$Xf���LΟ�'Ό� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ʡ7��|�xku��gQf�d����98%�m��{� k6��o� ��$Xf���LΟ�'Ό� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �ʡ7��|�xku��gQf�d����98%�m��{� k6��o� ��$Xf���LΟ�'Ό� �+�/�,�0̨̩� �� � _ � � 2 + 3����� E �2+6R̳� ���z G�EgL�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.704219789718355,
"port_category": "well_known",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 1001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f251cd0c40192dacc042c646376d54623c04ccaf",
"event_fingerprint": "78c96631e8bba424de4d774c7bfdf9390c5298ca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "d9e9ac8419848f46c86e1d0c8fade387",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1001,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02a17\u001a\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\u0017\ufffd98%\ufffdm\ufffd\ufffd{\ufffd \u0002k\u00036\ufffd\ufffdo\u05ca\ufffd\u001d\ufffd\u0014\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd\u0004'\u0004\u038c\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02a17\u001a\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\u0017\ufffd98%\ufffdm\ufffd\ufffd{\ufffd \u0002k\u00036\ufffd\ufffdo\u05ca\ufffd\u001d\ufffd\u0014\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd\u0004'\u0004\u038c\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u000bE \ufffd2+6R\u0333\ufffd \ufffd\ufffd\ufffdz\fG\ufffdEgL\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02a17\u001a\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\u0017\ufffd98%\ufffdm\ufffd\ufffd{\ufffd \u0002k\u00036\ufffd\ufffdo\u05ca\ufffd\u001d\ufffd\u0014\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd\u0004'\u0004\u038c\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0596cf74c41a7cddd0139c012495011007abb475",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02a17\u001a\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\u0017\ufffd98%\ufffdm\ufffd\ufffd{\ufffd \u0002k\u00036\ufffd\ufffdo\u05ca\ufffd\u001d\ufffd\u0014\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd\u0004'\u0004\u038c\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 1001,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u02a17\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\ufffd98%\ufffdm\ufffd\ufffd{\ufffd k6\ufffd\ufffdo\u05ca\ufffd\ufffd\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd'\u038c\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:1001 \u00b7 (reconnaissance)",
"target_port_label": "1001 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02a17\u001a\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\u0017\ufffd98%\ufffdm\ufffd\ufffd{\ufffd \u0002k\u00036\ufffd\ufffdo\u05ca\ufffd\u001d\ufffd\u0014\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd\u0004'\u0004\u038c\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 1001,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:1001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u02a17\ufffd\ufffd|\ufffdxku\ufffd\ufffdgQf\ufffdd\ufffd\ufffd\ufffd\ufffd98%\ufffdm\ufffd\ufffd{\ufffd k6\ufffd\ufffdo\u05ca\ufffd\ufffd\ufffd$Xf\ufffd\ufffd\ufffdL\u039f\ufffd'\u038c\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "1001 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 63,
"port_scan_ports_sample": [
1001,
2001,
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 63,
"scan_velocity_ports_per_s": 144.07,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5118 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5118 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5118
Chemin / cible
—
Service
TLS
Payload
� ���rW�-w<���%�J�ʭ�aɥ���3fv� �������\H ����5���ئ��0���'!Q �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���rW�-w<���%�J�ʭ�aɥ���3fv� �������\H ����5���ئ��0���'!Q �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���rW�-w<���%�J�ʭ�aɥ���3fv� �������\H ����5���ئ��0���'!Q �+�/�,�0̨̩� �� � _ � � 2 + 3������9ڋy7�G���G=�cp(7���H�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7102574420397545,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5118,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ac596d37b5fea6c0b5be7f6a345ad86ca05e6006",
"event_fingerprint": "5b277f762304d2fb65b9f2596442a8dfbb4a08de",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "4caa8cd0dbea70e8fb67ffb099f38e45",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5118,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdrW\u0011\ufffd-w<\ufffd\u001b\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \u0007\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u000f\ufffd\ufffd\\H\u001f\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdrW\u0011\ufffd-w<\ufffd\u001b\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \u0007\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u000f\ufffd\ufffd\\H\u001f\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd9\u068by7\u0001\ufffdG\ufffd\ufffd\ufffdG=\ufffdcp(7\ufffd\ufffd\ufffdH\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdrW\u0011\ufffd-w<\ufffd\u001b\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \u0007\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u000f\ufffd\ufffd\\H\u001f\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2a6a4e18da23bf97d4bc30716d5c61cf1668250",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdrW\u0011\ufffd-w<\ufffd\u001b\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \u0007\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u000f\ufffd\ufffd\\H\u001f\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5118,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdrW\ufffd-w<\ufffd\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\H\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5118 \u00b7 (reconnaissance)",
"target_port_label": "5118 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5118,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdrW\u0011\ufffd-w<\ufffd\u001b\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \u0007\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u000f\ufffd\ufffd\\H\u001f\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5118,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5118 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdrW\ufffd-w<\ufffd\ufffd\ufffd%\ufffdJ\ufffd\u02ad\ufffda\u0265\ufffd\u06dd\ufffd\ufffd3fv\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\H\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\u0626\ufffd\ufffd0\ufffd\ufffd\ufffd'!Q\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5118 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 64,
"port_scan_ports_sample": [
1001,
2001,
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 64,
"scan_velocity_ports_per_s": 144.18,
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
6002 · X11 2
|
x11-2
|
Scan de ports
port scan syn · via X11 2:6002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
X11-2
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6002
Chemin / cible
—
Service
X11 2
Payload
� �L�bѶ���f��Ά�ʵ��24b� �{T���� �$�ц��{t �������ỳ ^�B XW� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �L�bѶ���f��Ά�ʵ��24b� �{T���� �$�ц��{t �������ỳ
^�B XW� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �L�bѶ���f��Ά�ʵ��24b� �{T���� �$�ц��{t �������ỳ ^�B XW� �+�/�,�0̨̩� �� � _ � � 2 + 3���� t^,&�� z�+��6�G�R��c�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a",
"emulator_response_len": 36,
"bytes_in": 1483,
"payload_entropy": 7.737255880192322,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "x11-2",
"app_proto": "x11-2",
"asn": 23470,
"country": "HK",
"dst_port": 6002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a81c8df21c04c84e9b1392c4f59c812f21771e58",
"event_fingerprint": "5bb60b083df38d039195128a90b981e4666bb51c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "x11-2",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "63d999ca6a0e764ee95307df9021b5df",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6002,
"service": "x11-2",
"service_name": "x11-2",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdb\u0476\ufffd\u0003\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\u001e\ufffd{T\ufffd\ufffd\ufffd\u000e\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdB\fX\u0018\u001b\u0001W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdb\u0476\ufffd\u0003\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\u001e\ufffd{T\ufffd\ufffd\ufffd\u000e\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdB\fX\u0018\u001b\u0001W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001et^,&\ufffd\u0013\ufffd\u001cz\ufffd+\u0015\ufffd\ufffd6\ufffdG\ufffdR\ufffd\u0006\ufffdc\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdb\u0476\ufffd\u0003\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\u001e\ufffd{T\ufffd\ufffd\ufffd\u000e\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdB\fX\u0018\u001b\u0001W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6368fe2e73e366311cb98fa579a1a526152653f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdb\u0476\ufffd\u0003\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\u001e\ufffd{T\ufffd\ufffd\ufffd\u000e\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdB\fX\u0018\u001b\u0001W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 6002,
"service": "x11-2",
"service_label_fr": "X11 2"
},
"evidence_snippet": "\ufffd\ufffdL\ufffdb\u0476\ufffd\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\ufffd{T\ufffd\ufffd\ufffd\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdBXW\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via X11 2:6002 \u00b7 (reconnaissance)",
"target_port_label": "6002 \u00b7 X11 2",
"emulator_service": "x11-2",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 2 \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "x11-2",
"service_label_fr": "X11 2",
"dst_port": 6002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-x11-2",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdb\u0476\ufffd\u0003\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\u001e\ufffd{T\ufffd\ufffd\ufffd\u000e\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdB\fX\u0018\u001b\u0001W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 6002,
"service": "x11-2",
"service_label_fr": "X11 2"
},
"attack_vector": "port scan syn \u00b7 via X11 2:6002 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdL\ufffdb\u0476\ufffd\ufffd\ufffdf\ufffd\ufffd\u0386\ufffd\u02b5\ufffd\ufffd24b\ufffd\ufffd{T\ufffd\ufffd\ufffd\ufffd \ufffd$\ufffd\u0446\ufffd\ufffd{t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u0340\r^\ufffdBXW\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "6002 \u00b7 X11 2",
"emulator_service": "x11-2",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "x11_2",
"service_banner": "honeypot-x11-2",
"service_os": "linux",
"dst_port": "6002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 65,
"port_scan_ports_sample": [
1001,
2001,
5001,
5002,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 65,
"scan_velocity_ports_per_s": 144.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
5053 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5053 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5053
Chemin / cible
—
Service
TLS
Payload
� �x�ElA���X�D�m�hֱ��A����O���� ���� ������ڄ�U-����(��b�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �x�ElA���X�D�m�hֱ��A����O���� ���� ������ڄ�U-����(��b�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �x�ElA���X�D�m�hֱ��A����O���� ���� ������ڄ�U-����(��b�� �+�/�,�0̨̩� �� � _ � � 2 + 3����?j\<��+쿚�9Y,�R����ZF
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.745557019835386,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5053,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2b4b8fef13805e794ae120a55d60b0cf3e1c109e",
"event_fingerprint": "aaf5c54cab030e0b287b36c64f2dffd0895a8630",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "2685622942ece0e60ea2957475721636",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5053,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003x\ufffdElA\ufffd\ufffd\u0010\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\u0016\ufffdO\ufffd\ufffd\ufffd\u0004\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\u0006\ufffd\u0684\ufffdU-\ufffd\u0014\ufffd\ufffd\ufffd(\ufffd\u0007\u0013\ufffdb\ufffd\ufffd\u0004\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003x\ufffdElA\ufffd\ufffd\u0010\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\u0016\ufffdO\ufffd\ufffd\ufffd\u0004\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\u0006\ufffd\u0684\ufffdU-\ufffd\u0014\ufffd\ufffd\ufffd(\ufffd\u0007\u0013\ufffdb\ufffd\ufffd\u0004\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd?j\\<\ufffd\ufffd+\ucfda\ufffd9Y,\u0016\u0006\ufffd\u0012R\ufffd\ufffd\ufffd\ufffdZF",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003x\ufffdElA\ufffd\ufffd\u0010\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\u0016\ufffdO\ufffd\ufffd\ufffd\u0004\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\u0006\ufffd\u0684\ufffdU-\ufffd\u0014\ufffd\ufffd\ufffd(\ufffd\u0007\u0013\ufffdb\ufffd\ufffd\u0004\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "422eee725f9359e554d08029ad345ba334228628",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003x\ufffdElA\ufffd\ufffd\u0010\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\u0016\ufffdO\ufffd\ufffd\ufffd\u0004\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\u0006\ufffd\u0684\ufffdU-\ufffd\u0014\ufffd\ufffd\ufffd(\ufffd\u0007\u0013\ufffdb\ufffd\ufffd\u0004\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5053,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdx\ufffdElA\ufffd\ufffd\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0684\ufffdU-\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffdb\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5053 \u00b7 (reconnaissance)",
"target_port_label": "5053 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5053,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003x\ufffdElA\ufffd\ufffd\u0010\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\u0016\ufffdO\ufffd\ufffd\ufffd\u0004\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\u0006\ufffd\u0684\ufffdU-\ufffd\u0014\ufffd\ufffd\ufffd(\ufffd\u0007\u0013\ufffdb\ufffd\ufffd\u0004\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5053,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5053 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdx\ufffdElA\ufffd\ufffd\ufffdX\ufffdD\ufffdm\ufffdh\u05b1\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0684\ufffdU-\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffdb\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5053 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 66,
"port_scan_ports_sample": [
1001,
2001,
5001,
5002,
5053,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 66,
"scan_velocity_ports_per_s": 144.38,
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
4758 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:4758 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4758
Chemin / cible
—
Service
TLS
Payload
� ��E{�[.�{�Xj�����t��t�]�Z�N)�%=� E��8xW�� ���B�X�9}�D�Ac =���� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��E{�[.�{�Xj�����t��t�]�Z�N)�%=� E��8xW�� ���B�X�9}�D�Ac =���� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��E{�[.�{�Xj�����t��t�]�Z�N)�%=� E��8xW�� ���B�X�9}�D�Ac =���� �+�/�,�0̨̩� �� � _ � � 2 + 3������ e"\���% u�17���'E�E�y
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.728629497744423,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 4758,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bc3cdcf1dc74711924555c0ffca06f0a34862987",
"event_fingerprint": "80ed7ce349bc5ddffdf44387b3279ef6dacf6732",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "12187488adb280c8894f15343d243c67",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4758,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd\u0002%=\ufffd E\ufffd\ufffd8x\u0005W\ufffd\ufffd\u001d\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc\u0000=\ufffd\u0002\ufffd\ufffd\u0003\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd\u0002%=\ufffd E\ufffd\ufffd8x\u0005W\ufffd\ufffd\u001d\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc\u0000=\ufffd\u0002\ufffd\ufffd\u0003\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0003\ufffd\u000be\"\\\ufffd\ufffd\ufffd%\u0000u\ufffd17\ufffd\ufffd\ufffd'E\ufffdE\ufffdy",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd\u0002%=\ufffd E\ufffd\ufffd8x\u0005W\ufffd\ufffd\u001d\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc\u0000=\ufffd\u0002\ufffd\ufffd\u0003\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03e8ac492afbfe4f791c4a4a6df55c85529a2dab",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd\u0002%=\ufffd E\ufffd\ufffd8x\u0005W\ufffd\ufffd\u001d\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc\u0000=\ufffd\u0002\ufffd\ufffd\u0003\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 4758,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd%=\ufffd E\ufffd\ufffd8xW\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc=\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:4758 \u00b7 (reconnaissance)",
"target_port_label": "4758 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4758,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd\u0002%=\ufffd E\ufffd\ufffd8x\u0005W\ufffd\ufffd\u001d\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc\u0000=\ufffd\u0002\ufffd\ufffd\u0003\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 4758,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4758 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdE{\ufffd[.\ufffd{\ufffdXj\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdt\ufffd]\ufffdZ\ufffdN)\ufffd%=\ufffd E\ufffd\ufffd8xW\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdX\ufffd9}\ufffdD\ufffdAc=\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "4758 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4758"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 67,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5053,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066,
5067
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 67,
"scan_velocity_ports_per_s": 144.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5054 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5054 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5054
Chemin / cible
—
Service
TLS
Payload
� �� c,�;�� �̥z�6��}� �Iy���S5 }�W��#����g=�J*MNLmJ���ctt�k �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� c,�;��
�̥z�6��}� �Iy���S5 }�W��#����g=�J*MNLmJ���ctt�k �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �� c,�;�� �̥z�6��}� �Iy���S5 }�W��#����g=�J*MNLmJ���ctt�k �+�/�,�0̨̩� �� � _ � � 2 + 3������� A�JB)3�E'/ �>(H`Mw
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.736508791598768,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5054,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d3d67d21f6544b445c82e27976b2182b0ac1dee2",
"event_fingerprint": "a136f056da40d3e500b8a12c735c596b7746fcbb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "d2a901675d9f27848f82a5a54583aa13",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5054,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001dc,\u0018\b\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\u001d\ufffdIy\ufffd\ufffd\ufffdS5 \u001a}\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*M\u0001NLmJ\ufffd\b\ufffd\ufffdctt\ufffd\bk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001dc,\u0018\b\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\u001d\ufffdIy\ufffd\ufffd\ufffdS5 \u001a}\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*M\u0001NLmJ\ufffd\b\ufffd\ufffdctt\ufffd\bk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\rA\ufffdJB)3\ufffd\u0007E'\/\f\ufffd>(H`Mw\u001f\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001dc,\u0018\b\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\u001d\ufffdIy\ufffd\ufffd\ufffdS5 \u001a}\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*M\u0001NLmJ\ufffd\b\ufffd\ufffdctt\ufffd\bk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "debf05ba5da331fb819af0dcb8e1bda4bfaf5c04",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001dc,\u0018\b\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\u001d\ufffdIy\ufffd\ufffd\ufffdS5 \u001a}\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*M\u0001NLmJ\ufffd\b\ufffd\ufffdctt\ufffd\bk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5054,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdc,\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\ufffdIy\ufffd\ufffd\ufffdS5 }\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*MNLmJ\ufffd\ufffd\ufffdctt\ufffdk\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5054 \u00b7 (reconnaissance)",
"target_port_label": "5054 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5054,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001dc,\u0018\b\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\u001d\ufffdIy\ufffd\ufffd\ufffdS5 \u001a}\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*M\u0001NLmJ\ufffd\b\ufffd\ufffdctt\ufffd\bk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5054,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5054 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdc,\ufffd;\ufffd\ufffd\r \ufffd\u0325z\ufffd6\ufffd\ufffd}\ufffd\ufffdIy\ufffd\ufffd\ufffdS5 }\ufffdW\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffdg=\ufffdJ*MNLmJ\ufffd\ufffd\ufffdctt\ufffdk\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5054 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5054"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 68,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5053,
5054,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 68,
"scan_velocity_ports_per_s": 144.39,
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic",
"weblogic-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5051 · KAFKA SSL
|
kafka-ssl
|
Scan de ports
port scan syn · via KAFKA SSL:5051 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
KAFKA-SSL
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5051
Chemin / cible
—
Service
KAFKA SSL
Payload
� �&�5Ȇg�Ř>�WYNǧ*_��nWY�֙p%0� I�4Z� <D#�Z'�Fd�%��)���,��� B �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&�5Ȇg�Ř>�WYNǧ*_��nWY�֙p%0� I�4Z�
<D#�Z'�Fd�%��)���,��� B �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �&�5Ȇg�Ř>�WYNǧ*_��nWY�֙p%0� I�4Z� <D#�Z'�Fd�%��)���,��� B �+�/�,�0̨̩� �� � _ � � 2 + 3����%`�T)g�� �f~�'��T1�� ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f73736c20726561647920706f72743d353035310d0a",
"emulator_response_len": 40,
"bytes_in": 1483,
"payload_entropy": 7.711181496468988,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "kafka-ssl",
"app_proto": "kafka-ssl",
"asn": 23470,
"country": "HK",
"dst_port": 5051,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "083b38a2509fb454cfd0c5dba9d621f6567a854e",
"event_fingerprint": "104e61c717a0d99ada5892bd05c2b57840bcb49b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "kafka-ssl",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eeb67a3b6076dde5c49d6fb94df955dc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5051,
"service": "kafka-ssl",
"service_name": "kafka-ssl",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u0002\u01e7*\u000f_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4\u0010Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u0002\u01e7*\u000f_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4\u0010Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd%`\ufffdT)g\ufffd\ufffd \ufffdf~\ufffd'\ufffd\ufffdT1\ufffd\ufffd \ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u0002\u01e7*\u000f_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4\u0010Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db9b6c642d776a985fb0bf3e4feeda78ef83139d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u0002\u01e7*\u000f_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4\u0010Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5051,
"service": "kafka-ssl",
"service_label_fr": "KAFKA SSL"
},
"evidence_snippet": "\ufffd\ufffd&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u01e7*_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via KAFKA SSL:5051 \u00b7 (reconnaissance)",
"target_port_label": "5051 \u00b7 KAFKA SSL",
"emulator_service": "kafka-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA SSL \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka-ssl",
"service_label_fr": "KAFKA SSL",
"dst_port": 5051,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-ssl",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u0002\u01e7*\u000f_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4\u0010Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 5051,
"service": "kafka-ssl",
"service_label_fr": "KAFKA SSL"
},
"attack_vector": "port scan syn \u00b7 via KAFKA SSL:5051 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd&\ufffd5\u0206g\ufffd\u0158>\ufffdWYN\u01e7*_\ufffd\ufffdnWY\ufffd\u0599p%0\ufffd I\ufffd4Z\ufffd\n<D#\ufffdZ'\ufffdFd\ufffd%\ufffd\ufffd)\ufffd\ufffd\u05cc\ufffd,\ufffd\ufffd\ufffd B\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5051 \u00b7 KAFKA SSL",
"emulator_service": "kafka-ssl",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_ssl",
"service_banner": "honeypot-kafka-ssl",
"service_os": "linux",
"dst_port": "5051"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 69,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5051,
5053,
5054,
5057,
5058,
5059,
5061,
5062,
5063,
5064,
5065
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 69,
"scan_velocity_ports_per_s": 144.52,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_clienthello"
]
}
|
|
|
TCP |
5052 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5052 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5052
Chemin / cible
—
Service
TLS
Payload
� ��gڝ��Qa�_�`E�������;̥9 �)����� ��$���]���է�c������0�v`� �8� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��gڝ��Qa�_�`E�������;̥9 �)����� ��$���]���է�c������0�v`� �8� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��gڝ��Qa�_�`E�������;̥9 �)����� ��$���]���է�c������0�v`� �8� �+�/�,�0̨̩� �� � _ � � 2 + 3����gg��v����Y�gy;��O�t� F �
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.720466144122609,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5052,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9e303b98e1ce28fabbe59c078087b77d676bab5",
"event_fingerprint": "8793adb9d18e83a79eb7cb263fdf24ab768bf5a3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "52cde933edbbe094aad5ca4149ffb632",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5052,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\u001d\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\u0012\ufffd\ufffd\u0014\ufffd\ufffd\ufffd0\ufffdv`\ufffd\u0014 \ufffd8\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\u001d\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\u0012\ufffd\ufffd\u0014\ufffd\ufffd\ufffd0\ufffdv`\ufffd\u0014 \ufffd8\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdgg\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffdY\u0011\ufffdgy;\ufffd\ufffdO\ufffdt\ufffd\u0000F\u001d\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\u001d\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\u0012\ufffd\ufffd\u0014\ufffd\ufffd\ufffd0\ufffdv`\ufffd\u0014 \ufffd8\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a534f59463e5aa34113df03a7f6c54d1bbb1047a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\u001d\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\u0012\ufffd\ufffd\u0014\ufffd\ufffd\ufffd0\ufffdv`\ufffd\u0014 \ufffd8\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5052,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffdv`\ufffd \ufffd8\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5052 \u00b7 (reconnaissance)",
"target_port_label": "5052 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5052,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\u001d\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\u0012\ufffd\ufffd\u0014\ufffd\ufffd\ufffd0\ufffdv`\ufffd\u0014 \ufffd8\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5052,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5052 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdg\u069d\ufffd\ufffdQa\ufffd_\ufffd`E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\u03259\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd$\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\u0567\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffdv`\ufffd \ufffd8\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5052 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5052"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 70,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5051,
5052,
5053,
5054,
5057,
5058,
5059,
5061,
5062,
5063,
5064
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 70,
"scan_velocity_ports_per_s": 144.66,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5014 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5014 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5014
Chemin / cible
—
Service
TLS
Payload
� � � �`,�[�T�1��h��fxTp@�x�cm��H� �ȕ���T�kC�ȶ̈��CEDKT�s�[�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �
�`,�[�T�1��h��fxTp@�x�cm��H� �ȕ���T�kC�ȶ̈��CEDKT�s�[�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� � � �`,�[�T�1��h��fxTp@�x�cm��H� �ȕ���T�kC�ȶ̈��CEDKT�s�[�� �+�/�,�0̨̩� �� � _ � � 2 + 3�����:T\FSǧ%虖{� �ŘlP�/�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.702789682114184,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5014,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "28b1ccc1378327374048950b3d096af49532f418",
"event_fingerprint": "f2fb1d0b380affb9e0dbe215ab6a2db12ad77b25",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "08a8feb2cc81105ff695304d5c12bebc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5014,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003 \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffd\u0018H\ufffd \ufffd\u0215\u0005\ufffd\ufffd\ufffdT\ufffd\u0013kC\u0013\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003 \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffd\u0018H\ufffd \ufffd\u0215\u0005\ufffd\ufffd\ufffdT\ufffd\u0013kC\u0013\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd:T\\FS\u01e7%\u8656{\ufffd\r\ufffd\u0158lP\ufffd\/\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003 \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffd\u0018H\ufffd \ufffd\u0215\u0005\ufffd\ufffd\ufffdT\ufffd\u0013kC\u0013\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ab0e43257d9cc44aa09d37a3a7a7e8bdeea9010",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003 \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffd\u0018H\ufffd \ufffd\u0215\u0005\ufffd\ufffd\ufffdT\ufffd\u0013kC\u0013\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5014,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffdH\ufffd \ufffd\u0215\ufffd\ufffd\ufffdT\ufffdkC\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5014 \u00b7 (reconnaissance)",
"target_port_label": "5014 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5014,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003 \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffd\u0018H\ufffd \ufffd\u0215\u0005\ufffd\ufffd\ufffdT\ufffd\u0013kC\u0013\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5014,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5014 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd \ufffd\r\ufffd`,\ufffd[\ufffdT\ufffd1\ufffd\ufffdh\ufffd\ufffdfxTp@\ufffdx\ufffdcm\ufffd\ufffdH\ufffd \ufffd\u0215\ufffd\ufffd\ufffdT\ufffdkC\ufffd\u0236\u0308\ufffd\ufffdCEDKT\ufffds\ufffd[\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5014 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5014"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 71,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5014,
5051,
5052,
5053,
5054,
5057,
5058,
5059,
5061,
5062,
5063
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 71,
"scan_velocity_ports_per_s": 144.77,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5050 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5050 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5050
Chemin / cible
—
Service
TLS
Payload
� �]��%p4���in� cd�F�J����BH> -A �\v+��������1H8����9"2tZ�_ʥ(~�P �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �]��%p4���in� cd�F�J����BH> -A �\v+��������1H8����9"2tZ�_ʥ(~�P �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �]��%p4���in� cd�F�J����BH> -A �\v+��������1H8����9"2tZ�_ʥ(~�P �+�/�,�0̨̩� �� � _ � � 2 + 3����/ �P�blvuC�xcl���Pl�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.760994305485471,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5050,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57e9c00bf7d5143c60fb1240586127ea309b582f",
"event_fingerprint": "1548af4826bafc1de9355dc7914c04de04b973a7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "be83be465d3007c4e1ed30df7718ac58",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5050,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffd\fcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0012BH>\u0000-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffd\fcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0012BH>\u0000-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\/\b \ufffdP\ufffd\u0006blvuC\ufffdxcl\ufffd\ufffd\ufffdPl\u0014\b\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffd\fcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0012BH>\u0000-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1aacbff915db83959069e8b971cf178236a41523",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffd\fcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0012BH>\u0000-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffdcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffdBH>-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5050 \u00b7 (reconnaissance)",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5050,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0015]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffd\fcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0012BH>\u0000-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5050 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd]\ufffd\ufffd%p4\ufffd\ufffd\ufffdin\ufffdcd\ufffdF\ufffdJ\ufffd\ufffd\ufffd\ufffdBH>-A \ufffd\\v+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1H8\ufffd\ufffd\ufffd\ufffd9\"2tZ\ufffd_\u02a5(~\ufffdP\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 72,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5014,
5050,
5051,
5052,
5053,
5054,
5057,
5058,
5059,
5061,
5062
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 72,
"scan_velocity_ports_per_s": 144.92,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
9060 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:9060 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9060
Chemin / cible
—
Service
TLS
Payload
� �a/O|�� ߊ?r�����N�=v=�d�R� Z~��N0#��I%$�H��3 �r�kl�2d� u1 �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �a/O|�� ߊ?r�����N�=v=�d�R� Z~��N0#��I%$�H��3
�r�kl�2d�
u1 �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �a/O|�� ߊ?r�����N�=v=�d�R� Z~��N0#��I%$�H��3 �r�kl�2d� u1 �+�/�,�0̨̩� �� � _ � � 2 + 3�����۔;( r=*$yJ�Fc�\�|�(u �
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.740460231402148,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 9060,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d652c71196595d60f7792eceb351183f1a994b5c",
"event_fingerprint": "ecb7502b7f819f6908081ed0b336ac5247ec3fa4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "2b8579e4ebc7573b195608c6bde806bf",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9060,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003a\/\u000eO|\u001b\ufffd\ufffd\u0016\u000b\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\u0015=v=\ufffdd\ufffdR\ufffd Z~\u0011\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\u0011\ufffd2d\ufffd\nu1\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003a\/\u000eO|\u001b\ufffd\ufffd\u0016\u000b\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\u0015=v=\ufffdd\ufffdR\ufffd Z~\u0011\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\u0011\ufffd2d\ufffd\nu1\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u06d4;\u0003(\nr=*$yJ\ufffdFc\ufffd\\\ufffd|\ufffd(u\t\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003a\/\u000eO|\u001b\ufffd\ufffd\u0016\u000b\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\u0015=v=\ufffdd\ufffdR\ufffd Z~\u0011\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\u0011\ufffd2d\ufffd\nu1\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0f14195d8478d62cce8ba992477ce71e7dbc770",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003a\/\u000eO|\u001b\ufffd\ufffd\u0016\u000b\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\u0015=v=\ufffdd\ufffdR\ufffd Z~\u0011\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\u0011\ufffd2d\ufffd\nu1\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 9060,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffda\/O|\ufffd\ufffd\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd=v=\ufffdd\ufffdR\ufffd Z~\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\ufffd2d\ufffd\nu1\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:9060 \u00b7 (reconnaissance)",
"target_port_label": "9060 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9060,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003a\/\u000eO|\u001b\ufffd\ufffd\u0016\u000b\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\u0015=v=\ufffdd\ufffdR\ufffd Z~\u0011\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\u0011\ufffd2d\ufffd\nu1\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 9060,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:9060 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffda\/O|\ufffd\ufffd\u07ca?r\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd=v=\ufffdd\ufffdR\ufffd Z~\ufffd\ufffdN0#\ufffd\ufffdI%$\ufffdH\ufffd\ufffd3\r\ufffdr\ufffdkl\ufffd2d\ufffd\nu1\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "9060 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 73,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5014,
5050,
5051,
5052,
5053,
5054,
5057,
5058,
5059,
5061,
5062
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 73,
"scan_velocity_ports_per_s": 145.01,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5011 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5011 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5011
Chemin / cible
—
Service
TLS
Payload
� �IP�]Ӯ�~���pI��f�� z�&�T���� Z�����A�ːNj���K�X\[hm��3�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �IP�]Ӯ�~���pI��f�� z�&�T���� Z�����A�ːNj���K�X\[hm��3�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �IP�]Ӯ�~���pI��f�� z�&�T���� Z�����A�ːNj���K�X\[hm��3�� �+�/�,�0̨̩� �� � _ � � 2 + 3����:P�4�uV�:���<<fA��$��
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.726481497634927,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5011,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0bbab9062597e08df20e7261fddb103963984a57",
"event_fingerprint": "01afe48b4da5c1b0d6d555c15a52306d890e8946",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "3326b7aea6681e0c7398177a7d80562b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5011,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003IP\u0019\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\u0015\ufffd&\ufffd\u0012T\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffd\u0016K\ufffd\u0001X\u0006\\[hm\ufffd\ufffd3\ufffd\u0006\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003IP\u0019\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\u0015\ufffd&\ufffd\u0012T\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffd\u0016K\ufffd\u0001X\u0006\\[hm\ufffd\ufffd3\ufffd\u0006\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd:\u0010P\ufffd4\ufffduV\ufffd:\ufffd\ufffd\ufffd<<fA\ufffd\u0011\ufffd$\ufffd\u0014\ufffd\u000b",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003IP\u0019\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\u0015\ufffd&\ufffd\u0012T\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffd\u0016K\ufffd\u0001X\u0006\\[hm\ufffd\ufffd3\ufffd\u0006\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc16c65e11874ad198a76bd9db933f6f12eb0527",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003IP\u0019\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\u0015\ufffd&\ufffd\u0012T\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffd\u0016K\ufffd\u0001X\u0006\\[hm\ufffd\ufffd3\ufffd\u0006\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5011,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdIP\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\ufffd&\ufffdT\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffdK\ufffdX\\[hm\ufffd\ufffd3\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5011 \u00b7 (reconnaissance)",
"target_port_label": "5011 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5011,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003IP\u0019\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\u0015\ufffd&\ufffd\u0012T\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffd\u0016K\ufffd\u0001X\u0006\\[hm\ufffd\ufffd3\ufffd\u0006\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5011,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5011 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdIP\ufffd]\u04ee\ufffd~\ufffd\ufffd\ufffdpI\ufffd\ufffdf\ufffd\ufffd z\ufffd&\ufffdT\ufffd\ufffd\ufffd\ufffd Z\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\u02d0Nj\ufffd\ufffd\ufffdK\ufffdX\\[hm\ufffd\ufffd3\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5011 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 74,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5011,
5014,
5050,
5051,
5052,
5053,
5054,
5057,
5058,
5059,
5061
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 74,
"scan_velocity_ports_per_s": 145.07,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5015 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5015 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5015
Chemin / cible
—
Service
TLS
Payload
� �j��R��{�f�� � ��x,�ŽG�/ �B�*ʩ`�g2�`^�ֽ���t�������� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �j��R��{�f�� � ��x,�ŽG�/ �B�*ʩ`�g2�`^�ֽ���t�������� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �j��R��{�f�� � ��x,�ŽG�/ �B�*ʩ`�g2�`^�ֽ���t�������� �+�/�,�0̨̩� �� � _ � � 2 + 3���� �q��`��xB�J=L��{��GyLL$
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.757242738364543,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5015,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "282d2acfc6cc5abe97a5a9b52d3819ee93f1a86f",
"event_fingerprint": "6a290353766de5503bf2e42192dd8a7513b0b000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "c954d73e51ff4c62d22cc908cb985699",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5015,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003j\ufffd\ufffdR\ufffd\ufffd{\ufffdf\u0005\ufffd\ufffd\u000b\ufffd\u001d\ufffd\ufffdx\ud97d\udf0b\u0014,\u0017\ufffd\u017dG\ufffd\/ \ufffdB\u0014\ufffd*\u0019\u02a9`\ufffdg2\ufffd`\b^\ufffd\u05bd\ufffd\ufffd\ufffd\u001at\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003j\ufffd\ufffdR\ufffd\ufffd{\ufffdf\u0005\ufffd\ufffd\u000b\ufffd\u001d\ufffd\ufffdx\ud97d\udf0b\u0014,\u0017\ufffd\u017dG\ufffd\/ \ufffdB\u0014\ufffd*\u0019\u02a9`\ufffdg2\ufffd`\b^\ufffd\u05bd\ufffd\ufffd\ufffd\u001at\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\n\ufffdq\ufffd\ufffd`\ufffd\ufffdxB\ufffdJ=L\u001b\ufffd\ufffd{\ufffd\ufffdGyLL$",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003j\ufffd\ufffdR\ufffd\ufffd{\ufffdf\u0005\ufffd\ufffd\u000b\ufffd\u001d\ufffd\ufffdx\ud97d\udf0b\u0014,\u0017\ufffd\u017dG\ufffd\/ \ufffdB\u0014\ufffd*\u0019\u02a9`\ufffdg2\ufffd`\b^\ufffd\u05bd\ufffd\ufffd\ufffd\u001at\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94528b9e8cd10b6c2867311821ec0bc859f18642",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003j\ufffd\ufffdR\ufffd\ufffd{\ufffdf\u0005\ufffd\ufffd\u000b\ufffd\u001d\ufffd\ufffdx\ud97d\udf0b\u0014,\u0017\ufffd\u017dG\ufffd\/ \ufffdB\u0014\ufffd*\u0019\u02a9`\ufffdg2\ufffd`\b^\ufffd\u05bd\ufffd\ufffd\ufffd\u001at\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5015,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdj\ufffd\ufffdR\ufffd\ufffd{\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffdx\ud97d\udf0b,\ufffd\u017dG\ufffd\/ \ufffdB\ufffd*\u02a9`\ufffdg2\ufffd`^\ufffd\u05bd\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5015 \u00b7 (reconnaissance)",
"target_port_label": "5015 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5015,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003j\ufffd\ufffdR\ufffd\ufffd{\ufffdf\u0005\ufffd\ufffd\u000b\ufffd\u001d\ufffd\ufffdx\ud97d\udf0b\u0014,\u0017\ufffd\u017dG\ufffd\/ \ufffdB\u0014\ufffd*\u0019\u02a9`\ufffdg2\ufffd`\b^\ufffd\u05bd\ufffd\ufffd\ufffd\u001at\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5015,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5015 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdj\ufffd\ufffdR\ufffd\ufffd{\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffdx\ud97d\udf0b,\ufffd\u017dG\ufffd\/ \ufffdB\ufffd*\u02a9`\ufffdg2\ufffd`^\ufffd\u05bd\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5015 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5015"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 75,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5011,
5014,
5015,
5050,
5051,
5052,
5053,
5054,
5057,
5058,
5059
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 75,
"scan_velocity_ports_per_s": 145.12,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5013 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5013 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5013
Chemin / cible
—
Service
TLS
Payload
� ��I�th��z�xU���c���^��(��� NW�� �8m�����tCL$*7�̿F��쏅 �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��I�th��z�xU���c���^��(��� NW�� �8m�����tCL$*7�̿F��쏅 �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��I�th��z�xU���c���^��(��� NW�� �8m�����tCL$*7�̿F��쏅 �+�/�,�0̨̩� �� � _ � � 2 + 3����:�Q7�;�9Q8 L֙ ���;|�
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.736239896670841,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5013,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2ca281e73b1e40aea7f1ddf6d81ed0e2ae994a38",
"event_fingerprint": "86ca4559917a93ca5efb684e3eafb2c6e716802b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "7b321eb315b9065125e152e9bad76428",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5013,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0005I\ufffdt\u0003h\ufffd\ufffdz\ufffd\u0002xU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8\u0017m\ufffd\ufffd\ufffd\ufffd\ufffdt\u0019\u001bCL$*7\u0001\ufffd\u033fF\ufffd\ufffd\uc3c5\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0005I\ufffdt\u0003h\ufffd\ufffdz\ufffd\u0002xU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8\u0017m\ufffd\ufffd\ufffd\ufffd\ufffdt\u0019\u001bCL$*7\u0001\ufffd\u033fF\ufffd\ufffd\uc3c5\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd:\ufffdQ7\ufffd\u0011\u0003;\ufffd9Q8\u001f\u0017L\u0599\u001a\u0000\ufffd\ufffd\ufffd;|\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0005I\ufffdt\u0003h\ufffd\ufffdz\ufffd\u0002xU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8\u0017m\ufffd\ufffd\ufffd\ufffd\ufffdt\u0019\u001bCL$*7\u0001\ufffd\u033fF\ufffd\ufffd\uc3c5\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68d94353be925586fdcf1ba66b6daf461492d17c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0005I\ufffdt\u0003h\ufffd\ufffdz\ufffd\u0002xU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8\u0017m\ufffd\ufffd\ufffd\ufffd\ufffdt\u0019\u001bCL$*7\u0001\ufffd\u033fF\ufffd\ufffd\uc3c5\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5013,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdI\ufffdth\ufffd\ufffdz\ufffdxU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8m\ufffd\ufffd\ufffd\ufffd\ufffdtCL$*7\ufffd\u033fF\ufffd\ufffd\uc3c5\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5013 \u00b7 (reconnaissance)",
"target_port_label": "5013 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5013,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0005I\ufffdt\u0003h\ufffd\ufffdz\ufffd\u0002xU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8\u0017m\ufffd\ufffd\ufffd\ufffd\ufffdt\u0019\u001bCL$*7\u0001\ufffd\u033fF\ufffd\ufffd\uc3c5\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5013,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5013 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdI\ufffdth\ufffd\ufffdz\ufffdxU\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffd^\ufffd\ued5f\ufffd(\ufffd\ufffd\ufffd NW\ufffd\ufffd\t\ufffd8m\ufffd\ufffd\ufffd\ufffd\ufffdtCL$*7\ufffd\u033fF\ufffd\ufffd\uc3c5\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5013 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5013"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 76,
"port_scan_ports_sample": [
1001,
2001,
4758,
5001,
5002,
5011,
5013,
5014,
5015,
5050,
5051,
5052,
5053,
5054,
5057,
5058
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 76,
"scan_velocity_ports_per_s": 145.15,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
4001 · NOMAD HTTP
|
nomad-http
|
Scan de ports
port scan syn · via NOMAD HTTP:4001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
NOMAD-HTTP
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
nomad_http_emulated
nomad_http_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4001
Chemin / cible
—
Service
NOMAD HTTP
Payload
� ���'��u��֔d�l�� ��nw� ���qr� 괷�%�T� �Y?�|�.����\��� ?��� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���'��u��֔d�l�� ��nw� ���qr� 괷�%�T� �Y?�|�.����\���
?��� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ���'��u��֔d�l�� ��nw� ���qr� 괷�%�T� �Y?�|�.����\��� ?��� �+�/�,�0̨̩� �� � _ � � 2 + 3�����қ5�ͺ�f�GB oC����C;���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1483,
"payload_entropy": 7.7271902488544475,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "nomad-http",
"app_proto": "nomad-http",
"asn": 23470,
"country": "HK",
"dst_port": 4001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "da565258dc7abe4b690e72706a46aa33eb12379f",
"event_fingerprint": "1710fe16dc3b4fac12cb708baf813cd8f7c8cdf7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "nomad-http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e28a3a7a7cecbcb06c6744b0af15ae39",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4001,
"service": "nomad-http",
"service_name": "nomad-http",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\u0019\ufffdl\ufffd\u0003\ufffd\b\u001f\ufffd\ufffdnw\u0010\ufffd\u001f\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffd\u0012T\ufffd\u001f\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0016\r?\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\u0019\ufffdl\ufffd\u0003\ufffd\b\u001f\ufffd\ufffdnw\u0010\ufffd\u001f\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffd\u0012T\ufffd\u001f\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0016\r?\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u049b5\ufffd\u037a\ufffdf\ufffdGB oC\ufffd\ufffd\ufffd\ufffdC;\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\u0019\ufffdl\ufffd\u0003\ufffd\b\u001f\ufffd\ufffdnw\u0010\ufffd\u001f\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffd\u0012T\ufffd\u001f\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0016\r?\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d2d85234bfc48fdd101773411bf7e328ba27f8e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\u0019\ufffdl\ufffd\u0003\ufffd\b\u001f\ufffd\ufffdnw\u0010\ufffd\u001f\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffd\u0012T\ufffd\u001f\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0016\r?\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4001,
"service": "nomad-http",
"service_label_fr": "NOMAD HTTP"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\ufffdl\ufffd\ufffd\ufffd\ufffdnw\ufffd\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffdT\ufffd\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\r?\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via NOMAD HTTP:4001 \u00b7 (reconnaissance)",
"target_port_label": "4001 \u00b7 NOMAD HTTP",
"emulator_service": "nomad-http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NOMAD HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "nomad-http",
"service_label_fr": "NOMAD HTTP",
"dst_port": 4001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nomad-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\u0019\ufffdl\ufffd\u0003\ufffd\b\u001f\ufffd\ufffdnw\u0010\ufffd\u001f\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffd\u0012T\ufffd\u001f\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0016\r?\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 4001,
"service": "nomad-http",
"service_label_fr": "NOMAD HTTP"
},
"attack_vector": "port scan syn \u00b7 via NOMAD HTTP:4001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffdu\ufffd\ufffd\u0594d\ufffdl\ufffd\ufffd\ufffd\ufffdnw\ufffd\ufffd\ufffd\ufffdqr\ufffd \uad37\ufffd%\ufffdT\ufffd\ufffdY?\ufffd|\ufffd.\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\r?\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "4001 \u00b7 NOMAD HTTP",
"emulator_service": "nomad-http",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nomad_http",
"service_banner": "honeypot-nomad-http",
"service_os": "linux",
"dst_port": "4001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 77,
"port_scan_ports_sample": [
1001,
2001,
4001,
4758,
5001,
5002,
5011,
5013,
5014,
5015,
5050,
5051,
5052,
5053,
5054,
5057
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 77,
"scan_velocity_ports_per_s": 145.24,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"nomad-http",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"nomad_http_emulated",
"nomad_http_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
5012 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5012 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 2196848d251b217d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5012
Chemin / cible
—
Service
TLS
Payload
� ��ܿq��o ��Z*�t��=G3m=��pȶe�\� �K�D�e�Q����s��WmdJW(�7�)Z� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ܿq��o
��Z*�t��=G3m=��pȶe�\� �K�D�e�Q����s��WmdJW(�7�)Z� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��ܿq��o ��Z*�t��=G3m=��pȶe�\� �K�D�e�Q����s��WmdJW(�7�)Z� �+�/�,�0̨̩� �� � _ � � 2 + 3����a� g�K`g���K%&��dRe&j ��
Meta JSON brut
{
"tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.7331011173142885,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5012,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "528f4cc979cf51b6ba63db44e47b5446665c567a",
"event_fingerprint": "302e8b290754a03c9987b019859d9dc3d8f8b0c1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2196848d251b217de8b2c037e356c11d",
"payload_hash": "a2d8c2d4b24b77bf859765dab67fc871",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5012,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffd\u0006t\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWm\u0013\u000fdJW(\ufffd7\ufffd\u000e)Z\u0012\u0007\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffd\u0006t\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWm\u0013\u000fdJW(\ufffd7\ufffd\u000e)Z\u0012\u0007\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffda\u0006\ufffd\u001eg\ufffdK`g\ufffd\ufffd\ufffdK%&\ufffd\ufffddRe&j\t\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffd\u0006t\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWm\u0013\u000fdJW(\ufffd7\ufffd\u000e)Z\u0012\u0007\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f55e621422ac19822c3b90fe42f6d4f3ea9086ba",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffd\u0006t\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWm\u0013\u000fdJW(\ufffd7\ufffd\u000e)Z\u0012\u0007\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5012,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffdt\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWmdJW(\ufffd7\ufffd)Z\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5012 \u00b7 (reconnaissance)",
"target_port_label": "5012 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5012,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffd\u0006t\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWm\u0013\u000fdJW(\ufffd7\ufffd\u000e)Z\u0012\u0007\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "2196848d251b217de8b2c037e356c11d",
"port": 5012,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5012 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u073fq\ufffd\ufffdo\n\ufffd\ufffdZ*\ufffdt\ufffd\ufffd=G3m=\ufffd\ufffdp\u0236e\ufffd\\\ufffd \ufffdK\ufffdD\ufffde\ufffdQ\ufffd\ufffd\ufffd\ufffds\ufffd\ufffdWmdJW(\ufffd7\ufffd)Z\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "5012 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5012"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 78,
"port_scan_ports_sample": [
1001,
2001,
4001,
4758,
5001,
5002,
5011,
5012,
5013,
5014,
5015,
5050,
5051,
5052,
5053,
5054
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 78,
"scan_velocity_ports_per_s": 145.25,
"multi_category_scan": true,
"scan_category_diversity": [
"cloud",
"telecom"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"kafka-ssl",
"minio-console",
"nomad-http",
"oracle-em",
"sip-tls",
"tls",
"upnp-ssl",
"upnp-tcp"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
]
}
|