Renseignement sur les menaces

R.A.S. chinoise de Hong Kong

185.243.5.8

FAI ReliableSite.Net LLC Première vue 25/07/2026 18:28 UTC Dernière vue 27/07/2026 20:53 UTC Risque Moyen

Période analysée : 2026-06-29 → 2026-07-29

Activité suspecte — risque 60/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 60/100 Moyen

Première observation 25/07/2026 18:28 UTC

Dernière observation 27/07/2026 20:53 UTC

Événements (période) 331

MITRE ATT&CK principal T1046 297 occurrences

Activité suspecte — risque 60/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 100 · Bonus corrélation +14 · 5 tag(s) WAF

Comparaison ASN / FAI

ASN 23470 · 185.243.5.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 331 événements sur la période pour cette IP.

172.110.223.224 Sonde TLS 28/07/2026 02:56 UTC
185.243.5.47 Sonde SIP/VoIP 27/07/2026 22:42 UTC
185.243.5.56 Sonde SIP/VoIP 27/07/2026 09:43 UTC
185.243.5.73 Sonde port 27/07/2026 02:31 UTC
104.243.43.145 Sonde SSH 26/07/2026 20:46 UTC
172.110.223.96 Sonde port 1723/TCP 26/07/2026 10:52 UTC
172.110.223.121 Sonde TLS 24/07/2026 04:17 UTC
185.243.5.110 Sonde SIP/VoIP 22/07/2026 23:31 UTC

Événements (filtres)

331

Première observation

25/07/2026 18:28 UTC

Dernière observation

27/07/2026 20:53 UTC

Dernière activité (filtres)

27/07/2026 20:53 UTC

Événements 7j

331

Ports distincts (7j)

106

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 256 HTTP TCP 32 SIP TLS TCP 24 SIP TCP 3 NOMAD HTTP TCP 1 GRAFANA TCP 1 WEBLOGIC SSL TCP 1 ORACLE EM TCP 1 X11 TCP 1 TOR OR TCP 1 PERSONAL AGENT TCP 1 HTTP ALT 8001 TCP 1 X11 2 TCP 1 UPNP SSL TCP 1 REMOTEANYTHING TCP 1 KAFKA SSL TCP 1 X11 3 TCP 1 UPNP TCP TCP 1 MINIO CONSOLE TCP 1 WEBLOGIC TCP 1

TLS

256

HTTP

SIP TLS

SIP

NOMAD HTTP

GRAFANA

Géolocalisation

Origine réseau déclarée

R.A.S. chinoise de Hong Kong unknown unknown

FAI / réseau

Opérateur et dernière activité ban

ReliableSite.Net LLC 0 Port 5060 sip_voip_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:5079 · (reconnaissance) · → sip:62.3.50.33

Détails protocole

Méthode: OPTIONS
Chemin: sip:62.3.50.33
User-Agent: Avaya One-X Deskphone

Aperçu payload

OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK4b020819 To: <sip:62.3.50.33> From: <sip:scanner

Port / service

5079 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 5 tag(s) WAF

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +14

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

331 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

331 événement(s) — page 7/7

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
25/07/2026 18:28:56 UTC	TCP	5016 · TLS	tls	Scan de ports port scan syn · via TLS:5016 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5016 Chemin / cible — Service TLS Payload ��J\|�u�O��)zI�9\v�b!�>�� =��kL[�jM�#7h˭�3B��4G�z,�D ��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��J\|�u�O��)zI�9\v�b!�>�� =��kL[�jM�#7h˭�3B��4G�z,�D ��+�/�,�0̨̩� �� _� Requête brute (extrait) ��J\|�u�O��)zI�9\v�b!�>�� =��kL[�jM�#7h˭�3B��4G�z,�D ��+�/�,�0̨̩� �� _ � � 2+ 3��{{^Zpa�@�AM��)>R킱 Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.741954791696575, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5016, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "5b51c965effc16dbb05d995c9e345c144f626e0d", "event_fingerprint": "3fe418bfc167a83a6915c87a0a6a0cbfcfd6264f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "0fb70ef080b6a31ab626598396f27205", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5016, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdJ\|\ufffdu\ufffdO\u0011\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\u0013\\v\ufffdb\u0014!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd\u0004#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdJ\|\ufffdu\ufffdO\u0011\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\u0013\\v\ufffdb\u0014!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd\u0004#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0001\ufffd{{^Zp\u000fa\ufffd@\ufffdAM\ufffd\ufffd)>R\u001d\ud0b1", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdJ\|\ufffdu\ufffdO\u0011\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\u0013\\v\ufffdb\u0014!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd\u0004#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2be2382bde84f35c02d01973cf954050c45b9a38", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdJ\|\ufffdu\ufffdO\u0011\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\u0013\\v\ufffdb\u0014!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd\u0004#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5016, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdJ\|\ufffdu\ufffdO\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\\v\ufffdb!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5016 \u00b7 (reconnaissance)", "target_port_label": "5016 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (11 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5016, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdJ\|\ufffdu\ufffdO\u0011\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\u0013\\v\ufffdb\u0014!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd\u0004#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5016, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5016 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdJ\|\ufffdu\ufffdO\ufffd\ufffd\ufffd\ufffd)zI\ufffd9\\v\ufffdb!\ufffd>\ufffd\ufffd\r\ufffd\ufffd\ufffd \t=\ufffd\ufffdkL[\ufffdjM\ufffd#7h\u02ed\ufffd3B\ufffd\ufffd4G\ufffdz,\ufffdD \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5016 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5016" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 79, "port_scan_ports_sample": [ 1001, 2001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052, 5053 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 79, "scan_velocity_ports_per_s": 145.34, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 11, "multi_protocol_sample": [ "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls", "upnp-ssl", "upnp-tcp" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	8001 · HTTP ALT 8001	http-alt-8001	Scan de ports port scan syn · via HTTP ALT 8001:8001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTP-ALT-8001 WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8001 Chemin / cible — Service HTTP ALT 8001 Payload ��#Eɯ��eҺ�ߥz��A��P��.�� r��ݚ�h��ש��]�f��A�>�a�k�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��#Eɯ��eҺ�ߥz��A��P��.�� r��ݚ�h��ש��]�f��A�>�a�k�+�/�,�0̨̩� �� _� Requête brute (extrait) ��#Eɯ��eҺ�ߥz��A��P��.�� r��ݚ�h��ש��]�f��A�>�a�k�+�/�,�0̨̩� �� _ � � 2+ 3��3�� "�A/Ĳ�& �Wj�&}< Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1483, "payload_entropy": 7.725274239699556, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "http-alt-8001", "app_proto": "http-alt-8001", "asn": 23470, "country": "HK", "dst_port": 8001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "69294faa178c0ce7453e56a2e41c056254fe0287", "event_fingerprint": "a7663b25eee412a43bf0523e5c9c4eca004bd0ac", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http-alt-8001", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "46e79a2d8c08429050c7234c37f27769", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8001, "service": "http-alt-8001", "service_name": "http-alt-8001", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\u0000\ufffd\ufffd \u000br\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffd\u0005A\ufffd>\ufffda\ufffdk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\u0000\ufffd\ufffd \u000br\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffd\u0005A\ufffd>\ufffda\ufffdk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd3\u0011\ufffd\ufffd\u000b\"\ufffdA\/\u0132\ufffd& \ufffdWj\ufffd&}<", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\u0000\ufffd\ufffd \u000br\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffd\u0005A\ufffd>\ufffda\ufffdk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff845cb7c56421110fb6ba1beb7f5df8a02eb998", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\u0000\ufffd\ufffd \u000br\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffd\u0005A\ufffd>\ufffda\ufffdk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 8001, "service": "http-alt-8001", "service_label_fr": "HTTP ALT 8001" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd r\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffdA\ufffd>\ufffda\ufffdk\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via HTTP ALT 8001:8001 \u00b7 (reconnaissance)", "target_port_label": "8001 \u00b7 HTTP ALT 8001", "emulator_service": "http-alt-8001", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8001 \u2014 multi-protocole (12 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8001", "service_label_fr": "HTTP ALT 8001", "dst_port": 8001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8001", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\u0000\ufffd\ufffd \u000br\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\u001d\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffd\u0005A\ufffd>\ufffda\ufffdk\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 8001, "service": "http-alt-8001", "service_label_fr": "HTTP ALT 8001" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8001:8001 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#E\u026f\ufffd\ufffde\u04ba\ufffd\u07e5z\ufffd\ufffd\ufffdA\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd r\ufffd\ufffd\u075a\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u05e9\ufffd\ufffd]\ufffdf\ufffd\ufffdA\ufffd>\ufffda\ufffdk\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "8001 \u00b7 HTTP ALT 8001", "emulator_service": "http-alt-8001", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8001", "service_banner": "honeypot-http-alt-8001", "service_os": "linux", "dst_port": "8001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 80, "port_scan_ports_sample": [ 1001, 2001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052, 5053 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 80, "scan_velocity_ports_per_s": 145.44, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 12, "multi_protocol_sample": [ "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls", "upnp-ssl" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	6001 · X11	x11	Scan de ports port scan syn · via X11:6001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur X11 WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6001 Chemin / cible — Service X11 Payload ��\z��9��H��W꺚�$��m�eY�5 aEv ^Z�v��b_ ��!.&$pQݟ#8��ة�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\z��9��H��W꺚�$��m�eY�5 aEv ^Z�v��b_ ��!.&$pQݟ#8��ة�+�/�,�0̨̩� �� _� Requête brute (extrait) ��\z��9��H��W꺚�$��m�eY�5 aEv ^Z�v��b_ ��!.&$pQݟ#8��ة�+�/�,�0̨̩� �� _ � � 2+ 3��Ǘ��N��'M�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742078313120726561647920706f72743d363030310d0a", "emulator_response_len": 34, "bytes_in": 1483, "payload_entropy": 7.710143083644115, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "x11", "app_proto": "x11", "asn": 23470, "country": "HK", "dst_port": 6001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4a8ed7038a49bb030c9ad63cc53dd201cfa74f21", "event_fingerprint": "f9be7e9018a5680625474e3789d78248485a7d49", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "x11", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "02669ef9d417eedb185dcc40eda4f5cb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6001, "service": "x11", "service_name": "x11", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffde\u001fY\ufffd5 a\u0016Ev\r^Z\ufffd\u0001v\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffde\u001fY\ufffd5 a\u0016Ev\r^Z\ufffd\u0001v\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u01d7\ufffd\ufffd\ufffd\u0005\ufffd\ufffdN\u0006\ufffd\ufffd\ufffd\b\u0004'\u0013M\ufffd\ufffd\ufffd\u0016\u001f", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffde\u001fY\ufffd5 a\u0016Ev\r^Z\ufffd\u0001v\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2984bc3abf9c4424e4e09e44ee98262c7d402f30", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffde\u001fY\ufffd5 a\u0016Ev\r^Z\ufffd\u0001v\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 6001, "service": "x11", "service_label_fr": "X11" }, "evidence_snippet": "\ufffd\ufffd\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffdeY\ufffd5 aEv\r^Z\ufffdv\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)", "target_port_label": "6001 \u00b7 X11", "emulator_service": "x11", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 \u2014 multi-protocole (13 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "x11", "service_label_fr": "X11", "dst_port": 6001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffde\u001fY\ufffd5 a\u0016Ev\r^Z\ufffd\u0001v\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 6001, "service": "x11", "service_label_fr": "X11" }, "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\\z\ufffd\ufffd9\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\uae9a\ufffd$\ufffd\ufffdm\ufffdeY\ufffd5 aEv\r^Z\ufffdv\ufffd\ufffdb_ \ufffd\ufffd!.&$pQ\u075f#8\ufffd\ufffd\u0629\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6001 \u00b7 X11", "emulator_service": "x11", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11", "service_banner": "honeypot-x11", "service_os": "linux", "dst_port": "6001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 81, "port_scan_ports_sample": [ 1001, 2001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052, 5053 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 81, "scan_velocity_ports_per_s": 145.48, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 13, "multi_protocol_sample": [ "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls", "upnp-ssl" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	3001 · GRAFANA	grafana	Scan de ports port scan syn · via GRAFANA:3001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur GRAFANA WAF — Recommandation Surveiller Tags grafana_emulated grafana_payload net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3001 Chemin / cible — Service GRAFANA Payload ��2m��i�=lsJ��uq�86��P�� $�:Sc��W��r(��M$�f�N�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��2m��i�=lsJ��uq�86��P�� $�:Sc��W��r(��M$�f�N�+�/�,�0̨̩� �� _� Requête brute (extrait) ��2m��i�=lsJ��uq�86��P�� $�:Sc��W��r(��M$�f�N�+�/�,�0̨̩� �� _ � � 2+ 3��f��7�MT��f�{C}[K Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "bytes_in": 1483, "payload_entropy": 7.689516441568394, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "grafana", "app_proto": "grafana", "asn": 23470, "country": "HK", "dst_port": 3001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "235dc974634d04fd06f01d13733f23e0ea5023c5", "event_fingerprint": "0bf2cddedda6801585ea16f6b1fffb24713d4279", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "grafana", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b3cc009081cfcc770d86fa5837b6eabe", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3001, "service": "grafana", "service_name": "grafana", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001a\ufffd\ufffd2m\ufffd\ufffdi\ufffd\u0013=lsJ\ufffd\ufffd\ufffd\ufffdu\u001bq\ufffd86\ufffd\b\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:S\u0002c\u0016\ufffd\u000e\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\u0019\u0000r\u0017(\ufffd\ufffd\ufffdM$\u0016\ufffdf\ufffdN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001a\ufffd\ufffd2m\ufffd\ufffdi\ufffd\u0013=lsJ\ufffd\ufffd\ufffd\ufffdu\u001bq\ufffd86\ufffd\b\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:S\u0002c\u0016\ufffd\u000e\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\u0019\u0000r\u0017(\ufffd\ufffd\ufffdM$\u0016\ufffdf\ufffdN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u0013\u000f\ufffdf\ufffd\ufffd7\ufffd\u0016M\u000eT\ufffd\ufffd\ufffdf\ufffd{C}[K\u0014", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001a\ufffd\ufffd2m\ufffd\ufffdi\ufffd\u0013=lsJ\ufffd\ufffd\ufffd\ufffdu\u001bq\ufffd86\ufffd\b\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:S\u0002c\u0016\ufffd\u000e\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\u0019\u0000r\u0017(\ufffd\ufffd\ufffdM$\u0016\ufffdf\ufffdN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "be0b0867d36145ea75025985bf17668c06891629", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001a\ufffd\ufffd2m\ufffd\ufffdi\ufffd\u0013=lsJ\ufffd\ufffd\ufffd\ufffdu\u001bq\ufffd86\ufffd\b\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:S\u0002c\u0016\ufffd\u000e\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\u0019\u0000r\u0017(\ufffd\ufffd\ufffdM$\u0016\ufffdf\ufffdN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 3001, "service": "grafana", "service_label_fr": "GRAFANA" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd2m\ufffd\ufffdi\ufffd=lsJ\ufffd\ufffd\ufffd\ufffduq\ufffd86\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:Sc\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdr(\ufffd\ufffd\ufffdM$\ufffdf\ufffdN\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via GRAFANA:3001 \u00b7 (reconnaissance)", "target_port_label": "3001 \u00b7 GRAFANA", "emulator_service": "grafana", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via GRAFANA \u2014 multi-protocole (14 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "grafana", "service_label_fr": "GRAFANA", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-grafana", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001a\ufffd\ufffd2m\ufffd\ufffdi\ufffd\u0013=lsJ\ufffd\ufffd\ufffd\ufffdu\u001bq\ufffd86\ufffd\b\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:S\u0002c\u0016\ufffd\u000e\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\u0019\u0000r\u0017(\ufffd\ufffd\ufffdM$\u0016\ufffdf\ufffdN\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 3001, "service": "grafana", "service_label_fr": "GRAFANA" }, "attack_vector": "port scan syn \u00b7 via GRAFANA:3001 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd2m\ufffd\ufffdi\ufffd=lsJ\ufffd\ufffd\ufffd\ufffduq\ufffd86\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd $\ufffd:Sc\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdr(\ufffd\ufffd\ufffdM$\ufffdf\ufffdN\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "3001 \u00b7 GRAFANA", "emulator_service": "grafana", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "grafana", "service_banner": "honeypot-grafana", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 82, "port_scan_ports_sample": [ 1001, 2001, 3001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 82, "scan_velocity_ports_per_s": 145.43, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 14, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "grafana_emulated", "grafana_payload", "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	5119 · TLS	tls	Scan de ports port scan syn · via TLS:5119 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5119 Chemin / cible — Service TLS Payload ��ݲ�� 8�_��zH��ӿ%\�0V F� gxx���$}'P�� \��d�hg�v��+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ݲ�� 8�_��zH��ӿ%\�0V F� gxx���$}'P�� \��d�hg�v��+�/�,�0̨̩� �� _� Requête brute (extrait) ��ݲ�� 8�_��zH��ӿ%\�0V F� gxx���$}'P�� \��d�hg�v��+�/�,�0̨̩� �� _ � � 2+ 3��C�o��g��)m V��"iV�k�ȧ Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.748557172315661, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5119, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "88d449ea15e581209e63df95fc66c362a765769c", "event_fingerprint": "cd1ee69a9e60deda02c86a4fd60b7f450a48f2cb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "f6cddcfb5ba953e434b51d1828d78422", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5119, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0772\u0014\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\u0017\tF\ufffd gxx\ufffd\ufffd\u0014\ufffd\u0016\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdh\u0000g\ufffdv\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0772\u0014\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\u0017\tF\ufffd gxx\ufffd\ufffd\u0014\ufffd\u0016\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdh\u0000g\ufffdv\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdC\ufffdo\ufffd\ufffdg\ufffd\ufffd)m \rV\ufffd\ufffd\"iV\ufffdk\ufffd\u0227\u001b", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0772\u0014\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\u0017\tF\ufffd gxx\ufffd\ufffd\u0014\ufffd\u0016\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdh\u0000g\ufffdv\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a1a152cd7a3b8df9000ed1cb8f8115550a651ca", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0772\u0014\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\u0017\tF\ufffd gxx\ufffd\ufffd\u0014\ufffd\u0016\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdh\u0000g\ufffdv\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5119, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\u0772\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\tF\ufffd gxx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdhg\ufffdv\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5119 \u00b7 (reconnaissance)", "target_port_label": "5119 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (14 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5119, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0772\u0014\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\u0017\tF\ufffd gxx\ufffd\ufffd\u0014\ufffd\u0016\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdh\u0000g\ufffdv\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5119, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5119 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\u0772\ufffd\ufffd\ufffd\t8\ufffd_\ufffd\ufffd\ufffdzH\ufffd\ufffd\ufffd\ufffd\u04ff%\\\ufffd0V\tF\ufffd gxx\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd$}'P\ufffd\ufffd\ufffd\n\\\ufffd\ufffdd\ufffdhg\ufffdv\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5119 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5119" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 83, "port_scan_ports_sample": [ 1001, 2001, 3001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 83, "scan_velocity_ports_per_s": 145.47, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 14, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	6003 · X11 3	x11-3	Scan de ports port scan syn · via X11 3:6003 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur X11-3 WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6003 Chemin / cible — Service X11 3 Payload ��!�C�X�iu��S�VT�_�w��#z3�T�� \I> bw�Y��8�{:�G<��pg�ӤW��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��!�C�X�iu��S�VT�_�w��#z3�T�� \I> bw�Y��8�{:�G<��pg�ӤW��+�/�,�0̨̩� �� _� Requête brute (extrait) ��!�C�X�iu��S�VT�_�w��#z3�T�� \I> bw�Y��8�{:�G<��pg�ӤW��+�/�,�0̨̩� �� _ � � 2+ 3��L�X��̰?t�K�G=�#��\|g�W1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3320726561647920706f72743d363030330d0a", "emulator_response_len": 36, "bytes_in": 1483, "payload_entropy": 7.74218580818673, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "x11-3", "app_proto": "x11-3", "asn": 23470, "country": "HK", "dst_port": 6003, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "bb218c931165927dd4b1b8b5c2fefc71d7a69a8d", "event_fingerprint": "ada5b6ed514b4d7994c2dd82f72568613644d171", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "x11-3", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "40ca91538d187c2fbe1d200750309ba6", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6003, "service": "x11-3", "service_name": "x11-3", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\u0005!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd\u0018_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd\u0017{:\ufffd\u0014G<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\u0005!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd\u0018_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd\u0017{:\ufffd\u0014G<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdL\ufffdX\ufffd\ufffd\u0330?t\ufffdK\ufffdG=\ufffd#\ufffd\ufffd\|g\ufffdW\u00191", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\u0005!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd\u0018_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd\u0017{:\ufffd\u0014G<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "224772be04c2e93a6bdb359d151ec503de21ea7b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\u0005!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd\u0018_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd\u0017{:\ufffd\u0014G<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 6003, "service": "x11-3", "service_label_fr": "X11 3" }, "evidence_snippet": "\ufffd\ufffd\ufffd!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd{:\ufffdG<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via X11 3:6003 \u00b7 (reconnaissance)", "target_port_label": "6003 \u00b7 X11 3", "emulator_service": "x11-3", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 3 \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "x11-3", "service_label_fr": "X11 3", "dst_port": 6003, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-3", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\u0005!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd\u0018_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd\u0017{:\ufffd\u0014G<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 6003, "service": "x11-3", "service_label_fr": "X11 3" }, "attack_vector": "port scan syn \u00b7 via X11 3:6003 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd!\ufffdC\ufffdX\ufffdiu\ufffd\ufffdS\ufffdVT\ufffd_\ufffdw\ufffd\ufffd#z3\ufffdT\ufffd\ufffd \\I> bw\ufffdY\ufffd\ufffd8\ufffd{:\ufffdG<\ufffd\ufffd\ufffd\ufffd\ufffdpg\ufffd\u04e4W\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6003 \u00b7 X11 3", "emulator_service": "x11-3", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_3", "service_banner": "honeypot-x11-3", "service_os": "linux", "dst_port": "6003" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 84, "port_scan_ports_sample": [ 1001, 2001, 3001, 4001, 4758, 5001, 5002, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051, 5052 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 84, "scan_velocity_ports_per_s": 145.55, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	5010 · TLS	tls	Scan de ports port scan syn · via TLS:5010 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5010 Chemin / cible — Service TLS Payload ��^xDa��f��W��0��S�BrT�7) 5� �׷9�1��?e��Ύ�2�G�� i s�y�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��^xDa��f��W��0��S�BrT�7)5� �׷9�1��?e��Ύ�2�G��i s�y�+�/�,�0̨̩� �� _� Requête brute (extrait) ��^xDa��f��W��0��S�BrT�7) 5� �׷9�1��?e��Ύ�2�G�� i s�y�+�/�,�0̨̩� �� _ � � 2+ 3��j�0�Cqe� H�<ȡ� �� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.74594316689679, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5010, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9351be017ecee4150c6bd57d08d4dcd7d7c995fa", "event_fingerprint": "7ccb3178ea20cf3b37ac75400b112f25c0632535", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "59840ae3b3b88dbe83d07921150dd766", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5010, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0003^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)\u000b5\u0005\ufffd \ufffd\u000e\u05f79\ufffd\u00181\ufffd\ufffd?e\u0012\ufffd\ufffd\u0015\u038e\ufffd2\ufffdG\u0018\ufffd\u0010\ufffd\fi\ns\ufffdy\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0003^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)\u000b5\u0005\ufffd \ufffd\u000e\u05f79\ufffd\u00181\ufffd\ufffd?e\u0012\ufffd\ufffd\u0015\u038e\ufffd2\ufffdG\u0018\ufffd\u0010\ufffd\fi\ns\ufffdy\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdj\ufffd0\ufffd\u0007Cq\u0012e\ufffd\tH\u001e\u0002\ufffd<\u0221\ufffd\n\t\f\ufffd\ufffd\r", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0003^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)\u000b5\u0005\ufffd \ufffd\u000e\u05f79\ufffd\u00181\ufffd\ufffd?e\u0012\ufffd\ufffd\u0015\u038e\ufffd2\ufffdG\u0018\ufffd\u0010\ufffd\fi\ns\ufffdy\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "08748bfc9dfd9cdd5fce1a9b6a0470d8215b9de4", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0003^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)\u000b5\u0005\ufffd \ufffd\u000e\u05f79\ufffd\u00181\ufffd\ufffd?e\u0012\ufffd\ufffd\u0015\u038e\ufffd2\ufffdG\u0018\ufffd\u0010\ufffd\fi\ns\ufffdy\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5010, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)5\ufffd \ufffd\u05f79\ufffd1\ufffd\ufffd?e\ufffd\ufffd\u038e\ufffd2\ufffdG\ufffd\ufffdi\ns\ufffdy\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5010 \u00b7 (reconnaissance)", "target_port_label": "5010 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5010, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0003^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)\u000b5\u0005\ufffd \ufffd\u000e\u05f79\ufffd\u00181\ufffd\ufffd?e\u0012\ufffd\ufffd\u0015\u038e\ufffd2\ufffdG\u0018\ufffd\u0010\ufffd\fi\ns\ufffdy\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5010, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5010 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd^xDa\ufffd\ufffd\ufffdf\ufffd\ufffdW\ufffd\ufffd0\ufffd\ufffdS\ufffdBrT\ufffd7)5\ufffd \ufffd\u05f79\ufffd1\ufffd\ufffd?e\ufffd\ufffd\u038e\ufffd2\ufffdG\ufffd\ufffdi\ns\ufffdy\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5010 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5010" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 85, "port_scan_ports_sample": [ 1001, 2001, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5050, 5051 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 85, "scan_velocity_ports_per_s": 145.58, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	2002 · TLS	tls	Scan de ports port scan syn · via TLS:2002 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2002 Chemin / cible — Service TLS Payload ��=W/���\|�U�ə��湟�� f��$�1�=��y&��;�uG�+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��=W/���\|�U�ə��湟�� f��$�1�=��y&��;�uG�+�/�,�0̨̩� �� _� Requête brute (extrait) ��=W/���\|�U�ə��湟�� f��$�1�=��y&��;�uG�+�/�,�0̨̩� �� _ � � 2+ 3��țcX��p�KgרR�W��r31n< Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.715021687818453, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 2002, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1a05ad70fbd11b27958d82053a729b3541cf27bc", "event_fingerprint": "7fc6ef1d097c6c3309a7bab18e84a6cc33401f0f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "531178d23bf0a5610ff0e27b6a03a1c1", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 2002, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd=W\u001f\u0012\/\ufffd\ufffd\ufffd\|\ufffd\u0011U\ufffd\u0007\u0007\u0015\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u0000\b\ufffd$\ufffd\u001c1\ufffd=\ufffd\ufffd\ufffdy\u0011\u0007&\ufffd\ufffd;\u001c\ufffd\u0007uG\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd=W\u001f\u0012\/\ufffd\ufffd\ufffd\|\ufffd\u0011U\ufffd\u0007\u0007\u0015\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u0000\b\ufffd$\ufffd\u001c1\ufffd=\ufffd\ufffd\ufffdy\u0011\u0007&\ufffd\ufffd;\u001c\ufffd\u0007uG\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u021bc\u0006X\ufffd\ufffdp\ufffdKg\u05e8R\ufffdW\ufffd\ufffd\ufffdr31n<", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd=W\u001f\u0012\/\ufffd\ufffd\ufffd\|\ufffd\u0011U\ufffd\u0007\u0007\u0015\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u0000\b\ufffd$\ufffd\u001c1\ufffd=\ufffd\ufffd\ufffdy\u0011\u0007&\ufffd\ufffd;\u001c\ufffd\u0007uG\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b49c209b5cd4972637fba757d7db529a49e08110", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd=W\u001f\u0012\/\ufffd\ufffd\ufffd\|\ufffd\u0011U\ufffd\u0007\u0007\u0015\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u0000\b\ufffd$\ufffd\u001c1\ufffd=\ufffd\ufffd\ufffdy\u0011\u0007&\ufffd\ufffd;\u001c\ufffd\u0007uG\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 2002, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd=W\/\ufffd\ufffd\ufffd\|\ufffdU\ufffd\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd$\ufffd1\ufffd=\ufffd\ufffd\ufffdy&\ufffd\ufffd;\ufffduG\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:2002 \u00b7 (reconnaissance)", "target_port_label": "2002 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2002, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd=W\u001f\u0012\/\ufffd\ufffd\ufffd\|\ufffd\u0011U\ufffd\u0007\u0007\u0015\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u0000\b\ufffd$\ufffd\u001c1\ufffd=\ufffd\ufffd\ufffdy\u0011\u0007&\ufffd\ufffd;\u001c\ufffd\u0007uG\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 2002, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:2002 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd=W\/\ufffd*\ufffd\ufffd\|\ufffdU\ufffd\u0259\ufffd\ufffd\ufffd\ufffd\u6e5f\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd$\ufffd1\ufffd=\ufffd\ufffd\ufffdy&\ufffd\ufffd;\ufffduG\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "2002 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 86, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5050 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 86, "scan_velocity_ports_per_s": 145.67, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5018 · TLS	tls	Scan de ports port scan syn · via TLS:5018 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5018 Chemin / cible — Service TLS Payload ��\|��DW��G�R� �ȢU�9a� ��q��BkQ0b&r�t�͌G��7{�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\|��DW��G�R��ȢU�9a� ��q��BkQ0b&r�t�͌G��7{�+�/�,�0̨̩� �� _� Requête brute (extrait) ��\|��DW��G�R� �ȢU�9a� ��q��BkQ0b&r�t�͌G��7{�+�/�,�0̨̩� �� _ � � 2+ 3��zj�;#\|i��'��K�Y\� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.707885363280735, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5018, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c7187ba975e8126392876306132fea3a823a5aaf", "event_fingerprint": "9166ce41b66bbb375c2420161c8bebb08db9d9f0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "bee9acae1c9dda4a938e42e76e093940", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5018, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\u001a\u0011\ufffdDW\ufffd\ufffd\u0018G\ufffd\u001bR\ufffd\f\u000b\ufffd\u001d\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u0014\u034cG\ufffd\ufffd\ufffd\ufffd\u0015\ufffd\u000e\ufffd7{\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\u001a\u0011\ufffdDW\ufffd\ufffd\u0018G\ufffd\u001bR\ufffd\f\u000b\ufffd\u001d\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u0014\u034cG\ufffd\ufffd\ufffd\ufffd\u0015\ufffd\u000e\ufffd7{\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdzj\ufffd;#\u0013\|\u001fi\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffd\u0015Y\\\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\u001a\u0011\ufffdDW\ufffd\ufffd\u0018G\ufffd\u001bR\ufffd\f\u000b\ufffd\u001d\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u0014\u034cG\ufffd\ufffd\ufffd\ufffd\u0015\ufffd\u000e\ufffd7{\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5f83bfeecd73205baeba3108a21b65dd9649850", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\u001a\u0011\ufffdDW\ufffd\ufffd\u0018G\ufffd\u001bR\ufffd\f\u000b\ufffd\u001d\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u0014\u034cG\ufffd\ufffd\ufffd\ufffd\u0015\ufffd\u000e\ufffd7{\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5018, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\|\ufffd\ufffd\ufffdDW\ufffd\ufffdG\ufffdR\ufffd\ufffd\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u034cG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7{\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5018 \u00b7 (reconnaissance)", "target_port_label": "5018 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5018, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\u001a\u0011\ufffdDW\ufffd\ufffd\u0018G\ufffd\u001bR\ufffd\f\u000b\ufffd\u001d\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u0014\u034cG\ufffd\ufffd\ufffd\ufffd\u0015\ufffd\u000e\ufffd7{\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5018, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5018 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\|\ufffd\ufffd\ufffdDW\ufffd\ufffdG\ufffdR\ufffd\ufffd\u0222U\ufffd9a\ufffd \ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdBkQ0b&r\ufffdt\ufffd\u034cG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7{\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5018 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5018" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 87, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5018 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 87, "scan_velocity_ports_per_s": 145.76, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	26060 · TLS	tls	Scan de ports port scan syn · via TLS:26060 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26060 Chemin / cible — Service TLS Payload ��F=h�b�W�1�E��1_ �G[�/�rZ�6( �C� �kJa�OjM}��k��F>��Q7�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��F=h�b�W�1�E��1_ �G[�/�rZ�6( �C� �kJa�OjM}��k��F>��Q7�+�/�,�0̨̩� �� _� Requête brute (extrait) ��F=h�b�W�1�E��1_ �G[�/�rZ�6( �C� �kJa�OjM}��k��F>��Q7�+�/�,�0̨̩� �� _ � � 2+ 3��gíWC�wv�g @l%C�&��;��3� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.72780854584492, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 26060, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fa8c2c4e6efc92aa9666234afb717f847fe48a45", "event_fingerprint": "5107a973b34f0d2f6c8f090a4482be3a477d712a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "53d5327f5e68315eb6370bb710f44b52", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 26060, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdF=h\ufffd\u001fb\ufffdW\u0006\ufffd1\ufffdE\u0017\ufffd\u001d\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\u0003\r\ufffdkJa\ufffd\u0012OjM\u0003}\ufffd\ufffd\u0019\u000fk\ufffd\ufffd\ufffdF\u0016>\ufffd\ufffdQ7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdF=h\ufffd\u001fb\ufffdW\u0006\ufffd1\ufffdE\u0017\ufffd\u001d\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\u0003\r\ufffdkJa\ufffd\u0012OjM\u0003}\ufffd\ufffd\u0019\u000fk\ufffd\ufffd\ufffdF\u0016>\ufffd\ufffdQ7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdg\u00edWC\ufffdwv\ufffdg\f@l%C\ufffd&\ufffd\ufffd;\u0015\ufffd\ufffd3\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdF=h\ufffd\u001fb\ufffdW\u0006\ufffd1\ufffdE\u0017\ufffd\u001d\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\u0003\r\ufffdkJa\ufffd\u0012OjM\u0003}\ufffd\ufffd\u0019\u000fk\ufffd\ufffd\ufffdF\u0016>\ufffd\ufffdQ7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9bf93d052ff82b8bcbf0fd4c6d39bfd837aa4344", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdF=h\ufffd\u001fb\ufffdW\u0006\ufffd1\ufffdE\u0017\ufffd\u001d\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\u0003\r\ufffdkJa\ufffd\u0012OjM\u0003}\ufffd\ufffd\u0019\u000fk\ufffd\ufffd\ufffdF\u0016>\ufffd\ufffdQ7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 26060, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdF=h\ufffdb\ufffdW\ufffd1\ufffdE\ufffd\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\r\ufffdkJa\ufffdOjM}\ufffd\ufffdk\ufffd\ufffd\ufffdF>\ufffd\ufffdQ7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:26060 \u00b7 (reconnaissance)", "target_port_label": "26060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 26060, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdF=h\ufffd\u001fb\ufffdW\u0006\ufffd1\ufffdE\u0017\ufffd\u001d\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\u0003\r\ufffdkJa\ufffd\u0012OjM\u0003}\ufffd\ufffd\u0019\u000fk\ufffd\ufffd\ufffdF\u0016>\ufffd\ufffdQ7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 26060, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:26060 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdF=h\ufffdb\ufffdW\ufffd1\ufffdE\ufffd\ufffd1_\r\ufffdG[\ufffd\/\ufffdrZ\ufffd6( \ufffdC\ufffd\r\ufffdkJa\ufffdOjM}\ufffd\ufffdk\ufffd\ufffd\ufffdF>\ufffd\ufffdQ7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "26060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "26060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 88, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5018 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 88, "scan_velocity_ports_per_s": 145.77, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	6080 · TLS	tls	Scan de ports port scan syn · via TLS:6080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6080 Chemin / cible — Service TLS Payload ��Y1傱��3��t�ת#�{� ��L�>��+��Ƙ0%�Zg��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y1傱��3��t�ת#�{� ��L�>��+��Ƙ0%�Zg��+�/�,�0̨̩� �� _� Requête brute (extrait) ��Y1傱��3��t�ת#�{� ��L�>��+��Ƙ0%�Zg��+�/�,�0̨̩� �� _ � � 2+ 3��'�0�� u(�I��A�8YA \�m Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.761175063810979, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 6080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b79d5864797afb2b22829762ae90b625af08d015", "event_fingerprint": "3f9b6ba959d4800df12394edc7f2718fcdc88a37", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "3e1aa6e14e80df462b27c015ba8688bd", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6080, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffd\ufffdY1\u50b1\u0006\ufffd\ufffd\ufffd\ufffd\u0016\u0019\ufffd\ufffd\u0019\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u000f\ufffd\ufffdL\ufffd>\ufffd\ufffd\b\ufffd+\u0007\ufffd\ufffd\u0012\ufffd\u01980%\ufffd\u0012Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffd\ufffdY1\u50b1\u0006\ufffd\ufffd\ufffd\ufffd\u0016\u0019\ufffd\ufffd\u0019\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u000f\ufffd\ufffdL\ufffd>\ufffd\ufffd\b\ufffd+\u0007\ufffd\ufffd\u0012\ufffd\u01980%\ufffd\u0012Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd'\ufffd0\ufffd\ufffd\u000b\ufffdu(\ufffdI\u001b\ufffd\ufffdA\ufffd8YA\t\\\ufffdm", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffd\ufffdY1\u50b1\u0006\ufffd\ufffd\ufffd\ufffd\u0016\u0019\ufffd\ufffd\u0019\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u000f\ufffd\ufffdL\ufffd>\ufffd\ufffd\b\ufffd+\u0007\ufffd\ufffd\u0012\ufffd\u01980%\ufffd\u0012Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "35ab3fca480b8404c3d70acba2839e8268f34af3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffd\ufffdY1\u50b1\u0006\ufffd\ufffd\ufffd\ufffd\u0016\u0019\ufffd\ufffd\u0019\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u000f\ufffd\ufffdL\ufffd>\ufffd\ufffd\b\ufffd+\u0007\ufffd\ufffd\u0012\ufffd\u01980%\ufffd\u0012Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdY1\u50b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd>\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\u01980%\ufffdZg\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6080 \u00b7 (reconnaissance)", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6080, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffd\ufffdY1\u50b1\u0006\ufffd\ufffd\ufffd\ufffd\u0016\u0019\ufffd\ufffd\u0019\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u000f\ufffd\ufffdL\ufffd>\ufffd\ufffd\b\ufffd+\u0007\ufffd\ufffd\u0012\ufffd\u01980%\ufffd\u0012Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6080 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdY1\u50b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdt\ufffd\u05ea#\ufffd{\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd>\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\u01980%\ufffdZg\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 89, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5018 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 89, "scan_velocity_ports_per_s": 145.83, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5017 · TLS	tls	Scan de ports port scan syn · via TLS:5017 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5017 Chemin / cible — Service TLS Payload ��aR` �۾Z�R��L�U��U�W�u0��%��8 ��\|��-�]]��e&�� :�<t�_}]v�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��aR`�۾Z�R��L�U��U�W�u0��%��8 ��\|��-�]]��e&�� :�<t�_}]v�+�/�,�0̨̩� �� _� Requête brute (extrait) ��aR` �۾Z�R��L�U��U�W�u0��%��8 ��\|��-�]]��e&�� :�<t�_}]v�+�/�,�0̨̩� �� _ � � 2+ 3��{]B�0\4~�ɴ��VK Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.731888117910941, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5017, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e4c9663f689f248f2d4788d3092ca29078d1cb8a", "event_fingerprint": "4ffd1ac7aedb2d7f4d33c0b4c3902e9dc0309bad", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "01386e335eb4cc3e8372d0302259efdb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5017, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003aR`\f\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\u0002\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\u000f\ufffd\u0019\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}\u0011]v\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003aR`\f\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\u0002\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\u000f\ufffd\u0019\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}\u0011]v\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u0003\ufffd{]B\ufffd0\\4~\ufffd\u0274\ufffd\u001a\u0006\ufffd\ufffd\ufffdV\u000eK", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003aR`\f\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\u0002\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\u000f\ufffd\u0019\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}\u0011]v\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ad0c69d0d430e21377cfcedf098918db1d4c1ab", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003aR`\f\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\u0002\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\u000f\ufffd\u0019\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}\u0011]v\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5017, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdaR`\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\ufffd\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}]v\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5017 \u00b7 (reconnaissance)", "target_port_label": "5017 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5017, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003aR`\f\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\u0002\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\u000f\ufffd\u0019\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}\u0011]v\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5017, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5017 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdaR`\ufffd\u06feZ\ufffdR\ufffd\ufffdL\ufffdU\ufffd\ufffdU\ufffdW\ufffdu0\ufffd\ufffd\ufffd%\ufffd\ufffd8 \ufffd\ufffd\ufffd\|\ufffd\ufffd-\ufffd]]\ufffd\ufffd\ufffd\ufffde&\ufffd\ufffd\n\ufffd:\ufffd<t\ufffd_}]v\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5017 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 90, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 90, "scan_velocity_ports_per_s": 145.71, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5019 · TLS	tls	Scan de ports port scan syn · via TLS:5019 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5019 Chemin / cible — Service TLS Payload ��Z�� ?�2�BneC��=��P��7S� �-�~޹Y��T�hi��W�(�wm�o75��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Z�� ?�2�BneC��=��P��7S� �-�~޹Y��T�hi��W�(�wm�o75��+�/�,�0̨̩� �� _� Requête brute (extrait) ��Z�� ?�2�BneC��=��P��7S� �-�~޹Y��T�hi��W�(�wm�o75��+�/�,�0̨̩� �� _ � � 2+ 3��҉�_�@ٺ �Ճudz wFw2<". Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.720885742144841, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5019, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ab164e849eddd740a72a33b8f95b996e46b87f82", "event_fingerprint": "4a54b12798622247f1e85a715b1bfc9b14b6f25b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "02ac21f624477c17dc21576008cc12fb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5019, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdB\u0005neC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\u0000\ufffd \ufffd-\u0016\ufffd~\u07b9\u0007\u0011Y\ufffd\ufffdT\ufffdhi\ufffd\ufffd\u001dW\ufffd\u001e(\ufffdwm\ufffdo75\u000e\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdB\u0005neC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\u0000\ufffd \ufffd-\u0016\ufffd~\u07b9\u0007\u0011Y\ufffd\ufffdT\ufffdhi\ufffd\ufffd\u001dW\ufffd\u001e(\ufffdwm\ufffdo75\u000e\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0489\ufffd_\ufffd@\u067a\t\ufffd\u0543u\u0018dz\nwFw2\u0012<\".", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdB\u0005neC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\u0000\ufffd \ufffd-\u0016\ufffd~\u07b9\u0007\u0011Y\ufffd\ufffdT\ufffdhi\ufffd\ufffd\u001dW\ufffd\u001e(\ufffdwm\ufffdo75\u000e\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ccea3bd1a395ff848f1a0bf41c422f90aa77a27", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdB\u0005neC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\u0000\ufffd \ufffd-\u0016\ufffd~\u07b9\u0007\u0011Y\ufffd\ufffdT\ufffdhi\ufffd\ufffd\u001dW\ufffd\u001e(\ufffdwm\ufffdo75\u000e\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5019, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdBneC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\ufffd \ufffd-\ufffd~\u07b9Y\ufffd\ufffdT\ufffdhi\ufffd\ufffdW\ufffd(\ufffdwm\ufffdo75\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5019 \u00b7 (reconnaissance)", "target_port_label": "5019 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5019, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdB\u0005neC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\u0000\ufffd \ufffd-\u0016\ufffd~\u07b9\u0007\u0011Y\ufffd\ufffdT\ufffdhi\ufffd\ufffd\u001dW\ufffd\u001e(\ufffdwm\ufffdo75\u000e\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5019, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5019 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffd\ufffd\t\ufffd?\ufffd2\ufffdBneC\ufffd\ufffd\ufffd=\ufffd\ufffdP\ufffd\ufffd\ufffd7S\ufffd \ufffd-\ufffd~\u07b9Y\ufffd\ufffdT\ufffdhi\ufffd\ufffdW\ufffd(\ufffdwm\ufffdo75\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5019 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5019" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 91, "port_scan_ports_sample": [ 1001, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 91, "scan_velocity_ports_per_s": 145.67, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	1029 · TLS	tls	Scan de ports port scan syn · via TLS:1029 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1029 Chemin / cible — Service TLS Payload ��Z��c��Vy��9�o�"��)u��t\��& >�xrNE�� 끍�[�r͑��i�DL��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Z��c��Vy��9�o�"��)u��t\��& >�xrNE�� 끍�[�r͑��i�DL��+�/�,�0̨̩� �� _� Requête brute (extrait) ��Z��c��Vy��9�o�"��)u��t\��& >�xrNE�� 끍�[�r͑��i�DL��+�/�,�0̨̩� �� _ � � 2+ 3��h�qO��_0 c�X��rV�2� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.735219921517719, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 1029, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0e1fc1c3511433042554d02d5bfceabab0c96b5d", "event_fingerprint": "71b322c6f6a8c94d23d83526beb60e89696c9b81", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "560c0641404db223e78d8803fa14bb7e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1029, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdc\ufffd\u001f\ufffdVy\ufffd\u0001\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\u000f\ufffdt\\\ufffd\ufffd\u0006\ufffd\ufffd& \u0004\u000f>\ufffdxrN\u0013E\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdc\ufffd\u001f\ufffdVy\ufffd\u0001\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\u000f\ufffdt\\\ufffd\ufffd\u0006\ufffd\ufffd& \u0004\u000f>\ufffdxrN\u0013E\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0019h\ufffdqO\ufffd\ufffd_0\rc\ufffdX\ufffd\ufffd\u0013\ufffdrV\ufffd2\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdc\ufffd\u001f\ufffdVy\ufffd\u0001\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\u000f\ufffdt\\\ufffd\ufffd\u0006\ufffd\ufffd& \u0004\u000f>\ufffdxrN\u0013E\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f98952f68f9cfb4ad75ae61f75fd31f141d2681", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdc\ufffd\u001f\ufffdVy\ufffd\u0001\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\u000f\ufffdt\\\ufffd\ufffd\u0006\ufffd\ufffd& \u0004\u000f>\ufffdxrN\u0013E\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 1029, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffdc\ufffd\ufffdVy\ufffd\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\ufffdt\\\ufffd\ufffd\ufffd\ufffd& >\ufffdxrNE\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:1029 \u00b7 (reconnaissance)", "target_port_label": "1029 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1029, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdc\ufffd\u001f\ufffdVy\ufffd\u0001\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\u000f\ufffdt\\\ufffd\ufffd\u0006\ufffd\ufffd& \u0004\u000f>\ufffdxrN\u0013E\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 1029, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:1029 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffdc\ufffd\ufffdVy\ufffd\ufffd9\ufffdo\ufffd\"\ufffd\ufffd)u\ufffd\ufffdt\\\ufffd\ufffd\ufffd\ufffd& >\ufffdxrNE\ufffd\ufffd \ub04d\ufffd[\ufffdr\u0351\ufffd\ufffdi\ufffdDL\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "1029 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1029" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 92, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 92, "scan_velocity_ports_per_s": 145.62, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	6000 · TLS	tls	Scan de ports port scan syn · via TLS:6000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6000 Chemin / cible — Service TLS Payload ��h�ZڎM:墴�]��0P\�q�=SF�:J�/� �~#�p�7��O�C�"��P��4�Km=��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��h�ZڎM:墴�]��0P\�q�=SF�:J�/� �~#�p�7��O�C�"��P��4�Km=��+�/�,�0̨̩� �� _� Requête brute (extrait) ��h�ZڎM:墴�]��0P\�q�=SF�:J�/� �~#�p�7��O�C�"��P��4�Km=��+�/�,�0̨̩� �� _ � � 2+ 3��7$��0 [�s ٴ�/Rˢ � Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.734938846258957, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 6000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c9476ebf3542f5583cb9c14fd22179c39c79a03c", "event_fingerprint": "d07288cd3a3b4b4031fd1203b201a0b2136aa54f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "43e775c52dc088cbcc55468effbd29cc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6000, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003h\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffd\u0010q\ufffd=SF\ufffd:\u0018J\ufffd\/\u0003\ufffd \ufffd~\u0018#\u0010\ufffdp\u0019\ufffd\u000e7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003h\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffd\u0010q\ufffd=SF\ufffd:\u0018J\ufffd\/\u0003\ufffd \ufffd~\u0018#\u0010\ufffdp\u0019\ufffd\u000e7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd7$\ufffd\ufffd\ufffd0\n[\ufffd\u0013s\t\u0674\ufffd\/R\u02e2\u0019\r\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003h\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffd\u0010q\ufffd=SF\ufffd:\u0018J\ufffd\/\u0003\ufffd \ufffd~\u0018#\u0010\ufffdp\u0019\ufffd\u000e7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5e8cf7dcce198f0385f715f01d7e9d7cee3c1f42", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003h\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffd\u0010q\ufffd=SF\ufffd:\u0018J\ufffd\/\u0003\ufffd \ufffd~\u0018#\u0010\ufffdp\u0019\ufffd\u000e7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6000, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdh\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffdq\ufffd=SF\ufffd:J\ufffd\/\ufffd \ufffd~#\ufffdp\ufffd7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6000 \u00b7 (reconnaissance)", "target_port_label": "6000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003h\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffd\u0010q\ufffd=SF\ufffd:\u0018J\ufffd\/\u0003\ufffd \ufffd~\u0018#\u0010\ufffdp\u0019\ufffd\u000e7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6000, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6000 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdh\ufffdZ\u068eM:\u58b4\ufffd]\ufffd\ufffd0P\\\ufffdq\ufffd=SF\ufffd:J\ufffd\/\ufffd \ufffd~#\ufffdp\ufffd7\ufffd\ufffdO\ufffdC\ufffd\"\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd4\ufffdKm=\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6000 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 93, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 93, "scan_velocity_ports_per_s": 145.64, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5040 · TLS	tls	Scan de ports port scan syn · via TLS:5040 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5040 Chemin / cible — Service TLS Payload ��B��2�$y�p�̐��)_a�<�;[�q�� 8× Y�C[RL��xq��ʮdNJ�s5��]�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��B��2�$y�p�̐��)_a�<�;[�q�� 8× Y�C[RL��xq��ʮdNJ�s5��]�+�/�,�0̨̩� �� _� Requête brute (extrait) ��B��2�$y�p�̐��)_a�<�;[�q�� 8× Y�C[RL��xq��ʮdNJ�s5��]�+�/�,�0̨̩� �� _ � � 2+ 3��th�:L��v��3rE�syg; Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.743023438773749, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5040, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6ee415edbaafc009eabf9419a95e424d31a0c2ea", "event_fingerprint": "961d51239d3fb223b2935ddfe01e53daf0f27f73", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "15f5142d151de17dd4a117952cb0fc99", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5040, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\u001a\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffd\u0007s5\ufffd\ufffd\ufffd]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\u001a\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffd\u0007s5\ufffd\ufffd\ufffd]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdth\ufffd:L\u0000\ufffd\u0001\ufffdv\ufffd\ufffd\ufffd\ufffd3rE\ufffdsyg;\u0016", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\u001a\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffd\u0007s5\ufffd\ufffd\ufffd]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24dfd5de4bcce665338f1dc7645dddc95fc71c85", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\u001a\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffd\u0007s5\ufffd\ufffd\ufffd]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5040, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffds5\ufffd\ufffd\ufffd]\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5040 \u00b7 (reconnaissance)", "target_port_label": "5040 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (15 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5040, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\u001a\ufffd\ufffd\ufffd\ufffd \u0014\ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffd\u0007s5\ufffd\ufffd\ufffd]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5040, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5040 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffd2\ufffd$y\ufffdp\ufffd\u0310\ufffd\ufffd\ufffd)_a\ufffd<\ufffd;[\ufffdq\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd8\u00d7\tY\ufffdC[RL\ufffd\ufffdxq\ufffd\ufffd\u02aedNJ\ufffds5\ufffd\ufffd\ufffd]\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5040 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 94, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 94, "scan_velocity_ports_per_s": 145.72, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 15, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	9001 · TOR OR	tor-or	Scan de ports port scan syn · via TOR OR:9001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur TOR-OR WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello tor_exit_probe tor_or_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9001 Chemin / cible — Service TOR OR Payload ��.�כ�:�?}Tc %V�z!&�T��wf�ωA �'�cZ��0X!pJ?��zht��Qr/��+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��.�כ�:�?}Tc%V�z!&�T��wf�ωA �'�cZ��0X!pJ?��zht��Qr/��+�/�,�0̨̩� �� _� Requête brute (extrait) ��.�כ�:�?}Tc %V�z!&�T��wf�ωA �'�cZ��0X!pJ?��zht��Qr/��+�/�,�0̨̩� �� _ � � 2+ 3��u�D8�$jb��į!/��GX Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000000000000000", "emulator_response_len": 9, "bytes_in": 1483, "payload_entropy": 7.719045514897163, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tor-or", "app_proto": "tor-or", "asn": 23470, "country": "HK", "dst_port": 9001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8070529ea809db521e77d6c1e264f298470db612", "event_fingerprint": "ad0b471326720f66329abc8483052ac26a31da24", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tor-or", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f9f90ebca8cfc819246f5372d063bc0d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9001, "service": "tor-or", "service_name": "tor-or", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd.\ufffd\u05db\ufffd:\ufffd?\u001c}T\u0000c\f\u0003%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdc\u0002Z\ufffd\u0000\u001b\u0016\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\u0018\ufffdQ\u0012r\/\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd.\ufffd\u05db\ufffd:\ufffd?\u001c}T\u0000c\f\u0003%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdc\u0002Z\ufffd\u0000\u001b\u0016\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\u0018\ufffdQ\u0012r\/\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdu\ufffdD8\ufffd\u0019$\u001cjb\ufffd\u0001\ufffd\ufffd\u012f!\/\u001d\ufffd\u0088\ufffdGX", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd.\ufffd\u05db\ufffd:\ufffd?\u001c}T\u0000c\f\u0003%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdc\u0002Z\ufffd\u0000\u001b\u0016\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\u0018\ufffdQ\u0012r\/\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "78911cb7561f7fc4468a8b2a36b7f53088b7fbdc", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd.\ufffd\u05db\ufffd:\ufffd?\u001c}T\u0000c\f\u0003%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdc\u0002Z\ufffd\u0000\u001b\u0016\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\u0018\ufffdQ\u0012r\/\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 9001, "service": "tor-or", "service_label_fr": "TOR OR" }, "evidence_snippet": "\ufffd\ufffd\ufffd.\ufffd\u05db\ufffd:\ufffd?}Tc%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdcZ\ufffd\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\ufffdQr\/\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)", "target_port_label": "9001 \u00b7 TOR OR", "emulator_service": "tor-or", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (16 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tor-or", "service_label_fr": "TOR OR", "dst_port": 9001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tor-or", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd.\ufffd\u05db\ufffd:\ufffd?\u001c}T\u0000c\f\u0003%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdc\u0002Z\ufffd\u0000\u001b\u0016\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\u0018\ufffdQ\u0012r\/\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 9001, "service": "tor-or", "service_label_fr": "TOR OR" }, "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd.\ufffd\u05db\ufffd:\ufffd?}Tc%V\ufffdz!&\ufffdT\ufffd\ufffdwf\ufffd\u03c9A \ufffd'\ufffdcZ\ufffd\ufffd0X!pJ?\ufffd\ufffd\ufffdzht\ufffd\ufffd*Qr\/\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "9001 \u00b7 TOR OR", "emulator_service": "tor-or", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tor_or", "service_banner": "honeypot-tor-or", "service_os": "linux", "dst_port": "9001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 95, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 95, "scan_velocity_ports_per_s": 145.77, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 16, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello", "tor_exit_probe", "tor_or_emulated", "tor_or_payload" ] }
25/07/2026 18:28:56 UTC	TCP	17070 · TLS	tls	Scan de ports port scan syn · via TLS:17070 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17070 Chemin / cible — Service TLS Payload ��f��g}\|��/�D'��f{�.k�1� ^'�E�r��W'�-�mp!th�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��f��g}\|��/�D'��f{�.k�1� ^'�E�r��W'�-�mp!th�+�/�,�0̨̩� �� _� Requête brute (extrait) ��f��g}\|��/�D'��f{�.k�1� ^'�E�r��W'�-�mp!th�+�/�,�0̨̩� �� _ � � 2+ 3��{Dw��u�1+�~�:B�㰈�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.705226395504406, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 17070, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e568fcf4613c4ddef20a859058ef177ea4c36afb", "event_fingerprint": "d42c47b7e4ac6f5e6195e99a796dcff89334d68f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "f95a8e949f2f98c812c8f0057f7d3bf9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 17070, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdf\ufffd\ufffdg}\u0016\|\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\u0006\ufffd1\u001f\u001d\u0014\ufffd ^'\ufffd\u0003E\ufffdr\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\u0011\ufffd-\ufffdmp\u0014!th\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdf\ufffd\ufffdg}\u0016\|\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\u0006\ufffd1\u001f\u001d\u0014\ufffd ^'\ufffd\u0003E\ufffdr\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\u0011\ufffd-\ufffdmp\u0014!th\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd{Dw\ufffd\ufffdu\ufffd\u00111+\ufffd~\ufffd:B\ufffd\u0001\u3c08\ufffd\ufffd\u0014\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdf\ufffd\ufffdg}\u0016\|\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\u0006\ufffd1\u001f\u001d\u0014\ufffd ^'\ufffd\u0003E\ufffdr\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\u0011\ufffd-\ufffdmp\u0014!th\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "efab74ac0cf278a776d8ff8d7cec8514b59bd79a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdf\ufffd\ufffdg}\u0016\|\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\u0006\ufffd1\u001f\u001d\u0014\ufffd ^'\ufffd\u0003E\ufffdr\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\u0011\ufffd-\ufffdmp\u0014!th\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 17070, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdf\ufffd\ufffdg}\|\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\ufffd1\ufffd ^'\ufffdE\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\ufffd-\ufffdmp!th\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:17070 \u00b7 (reconnaissance)", "target_port_label": "17070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (16 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17070, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdf\ufffd\ufffdg}\u0016\|\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\u0006\ufffd1\u001f\u001d\u0014\ufffd ^'\ufffd\u0003E\ufffdr\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\u0011\ufffd-\ufffdmp\u0014!th\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 17070, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:17070 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffdf\ufffd\ufffdg}\|\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffdD'\ufffd\ufffdf{\ufffd.k\ufffd1\ufffd ^'\ufffdE\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW'\ufffd-\ufffdmp!th\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "17070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 96, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015, 5016 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 96, "scan_velocity_ports_per_s": 145.87, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 16, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	4050 · TLS	tls	Scan de ports port scan syn · via TLS:4050 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4050 Chemin / cible — Service TLS Payload ��?ҧ��/m�Ok��όHrUE��a��!H ��F{(�� IE��lÜY��"(8��C�+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��?ҧ��/m�Ok��όHrUE��a��!H ��F{(�� IE��lÜY��"(8��C�+�/�,�0̨̩� �� _� Requête brute (extrait) ��?ҧ��/m�Ok��όHrUE��a��!H ��F{(�� IE��lÜY��"(8��C�+�/�,�0̨̩� �� _ � � 2+ 3��6N��h��CB��/��s Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.736870072184811, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 4050, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8fa97a91fca7a08acbd3915da4b3b5e30696bc94", "event_fingerprint": "fe263d83c2068df77f5ae471741da6a5231741dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "1e6094f862464a8dc26a8cc14835ec6d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 4050, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrU\u001fE\u0016\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\u0011\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrU\u001fE\u0016\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\u0011\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd6N\u0000\ufffd\u0007\ufffd\ufffdh\ufffd\ufffdCB\ufffd\ufffd\ufffd\u0018\ufffd\/\ufffd\ufffds", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrU\u001fE\u0016\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\u0011\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1cc2abea8882534fc403d0136c8a88766d7c0402", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrU\u001fE\u0016\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\u0011\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 4050, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrUE\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:4050 \u00b7 (reconnaissance)", "target_port_label": "4050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (16 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4050, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrU\u001fE\u0016\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\u0011\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 4050, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:4050 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd?\u04a7\ufffd\ufffd\ufffd\ufffd\/m\ufffdOk\ufffd\ufffd\u03ccHrUE\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd!H \ufffd\ufffd\ufffdF{(\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffdIE\ufffd\ufffd\ufffdl\u00dcY\ufffd\ufffd\"(8\ufffd\ufffdC*\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "4050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 97, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4050, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 97, "scan_velocity_ports_per_s": 145.97, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 16, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	6060 · TLS	tls	Scan de ports port scan syn · via TLS:6060 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6060 Chemin / cible — Service TLS Payload ��Ɂh��H�}S�lQ��2�ܸ@FM�L�v3g �t2�NrZ[�Nc��d�g�F�p��m�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ɂh��H�}S�lQ��2�ܸ@FM�L�v3g �t2�NrZ[�Nc��d�g�F�p��m�+�/�,�0̨̩� �� _� Requête brute (extrait) ��Ɂh��H�}S�lQ��2�ܸ@FM�L�v3g �t2�NrZ[�Nc��d�g�F�p��m�+�/�,�0̨̩� �� _ � � 2+ 3��\|�X��}@�N$,��f� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.723766841451575, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 6060, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "12f79af77791363d3b1129b3b8351a7f05e2fdc6", "event_fingerprint": "97a4a1cae5b3ec6584e6887cfc8916403ae2151d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "cfb69b9491ece85ee7a1bec34c86a46b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6060, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0241h\ufffd\ufffdH\ufffd\u0007}S\ufffdl\u0011Q\ufffd\ufffd2\ufffd\u0738\u000e\u0016@FM\ufffdL\ufffdv\b3g \u000e\ufffdt\u00032\ufffdN\u0017rZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\u0010\ufffd\u0011\ufffdm\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0241h\ufffd\ufffdH\ufffd\u0007}S\ufffdl\u0011Q\ufffd\ufffd2\ufffd\u0738\u000e\u0016@FM\ufffdL\ufffdv\b3g \u000e\ufffdt\u00032\ufffdN\u0017rZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\u0010\ufffd\u0011\ufffdm\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0018\ufffd\|\ufffdX\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0000}\u0004@\ufffdN$,\ufffd\ufffdf\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0241h\ufffd\ufffdH\ufffd\u0007}S\ufffdl\u0011Q\ufffd\ufffd2\ufffd\u0738\u000e\u0016@FM\ufffdL\ufffdv\b3g \u000e\ufffdt\u00032\ufffdN\u0017rZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\u0010\ufffd\u0011\ufffdm\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e5f128dc8f88e5204fb287cd78987b92b7e81cc5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0241h\ufffd\ufffdH\ufffd\u0007}S\ufffdl\u0011Q\ufffd\ufffd2\ufffd\u0738\u000e\u0016@FM\ufffdL\ufffdv\b3g \u000e\ufffdt\u00032\ufffdN\u0017rZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\u0010\ufffd\u0011\ufffdm\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6060, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u0241h\ufffd\ufffdH\ufffd}S\ufffdlQ\ufffd\ufffd2\ufffd\u0738@FM\ufffdL\ufffdv3g \ufffdt2\ufffdNrZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\ufffd\ufffdm\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6060 \u00b7 (reconnaissance)", "target_port_label": "6060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (16 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6060, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0241h\ufffd\ufffdH\ufffd\u0007}S\ufffdl\u0011Q\ufffd\ufffd2\ufffd\u0738\u000e\u0016@FM\ufffdL\ufffdv\b3g \u000e\ufffdt\u00032\ufffdN\u0017rZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\u0010\ufffd\u0011\ufffdm\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6060, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6060 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\u0241h\ufffd\ufffdH\ufffd}S\ufffdlQ\ufffd\ufffd2\ufffd\u0738@FM\ufffdL\ufffdv3g \ufffdt2\ufffdNrZ[\ufffdNc\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffdg\ufffdF\ufffdp\ufffd\ufffdm\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 98, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4050, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 98, "scan_velocity_ports_per_s": 146.06, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 16, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5555 · PERSONAL AGENT	personal-agent	Scan de ports port scan syn · via PERSONAL AGENT:5555 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur PERSONAL-AGENT WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5555 Chemin / cible — Service PERSONAL AGENT Payload ��1��(�� ځ�/)�F��7Ś�Ie�n�� g�c;��l��C��w0�T��L��,��+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��1��(�� ځ�/)�F��7Ś�Ie�n�� g�c;��l��C��w0�T��L��,��+�/�,�0̨̩� �� _� Requête brute (extrait) ��1��(�� ځ�/)�F��7Ś�Ie�n�� g�c;��l��C��w0�T��L��,��+�/�,�0̨̩� �� _ � � 2+ 3��\\|z��I�� k\fإ�vo � Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420706572736f6e616c5f6167656e7420726561647920706f72743d353535350d0a", "emulator_response_len": 45, "bytes_in": 1483, "payload_entropy": 7.765535431356215, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "personal-agent", "app_proto": "personal-agent", "asn": 23470, "country": "HK", "dst_port": 5555, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "fde7f3af2f3711ddb3cc053e221e9d1489cafeb0", "event_fingerprint": "28577e65be3e827a3359af3ccdb4e382cdc33cba", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "personal-agent", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "771f44f314d718fe65c206825560ad42", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5555, "service": "personal-agent", "service_name": "personal-agent", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd1\ufffd\u0006\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\f\ufffd \u0005\ufffd\u001bg\u0012\ufffd\u001bc;\ufffd\ufffdl\ufffd\u0010\u0019\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffd\u0016L\ufffd\ufffd,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd1\ufffd\u0006\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\f\ufffd \u0005\ufffd\u001bg\u0012\ufffd\u001bc;\ufffd\ufffdl\ufffd\u0010\u0019\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffd\u0016L\ufffd\ufffd,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\\\|\u0001z\ufffd\ufffdI\ufffd\u0016\ufffd\u000b\ufffdk\\f\u0625\ufffdv\u0006o\r\ufffd\u0089", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd1\ufffd\u0006\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\f\ufffd \u0005\ufffd\u001bg\u0012\ufffd\u001bc;\ufffd\ufffdl\ufffd\u0010\u0019\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffd\u0016L\ufffd\ufffd,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b0a07878f5bd7f33fe92d8f3add389ab1a7e3150", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd1\ufffd\u0006\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\f\ufffd \u0005\ufffd\u001bg\u0012\ufffd\u001bc;\ufffd\ufffdl\ufffd\u0010\u0019\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffd\u0016L\ufffd\ufffd,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\ufffd \ufffdg\ufffdc;\ufffd\ufffdl\ufffd\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffdL\ufffd\ufffd,\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via PERSONAL AGENT:5555 \u00b7 (reconnaissance)", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PERSONAL AGENT \u2014 multi-protocole (17 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "personal-agent", "service_label_fr": "PERSONAL AGENT", "dst_port": 5555, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-personal-agent", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd1\ufffd\u0006\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\f\ufffd \u0005\ufffd\u001bg\u0012\ufffd\u001bc;\ufffd\ufffdl\ufffd\u0010\u0019\ufffdC\ufffd\ufffdw0\ufffdT\ufffd\ufffd\u0016L\ufffd\ufffd,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "attack_vector": "port scan syn \u00b7 via PERSONAL AGENT:5555 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd1\ufffd\ufffd(\ufffd\ufffd\n\u0681\ufffd\/)\ufffdF\ufffd\ufffd7\u015a\ufffdIe\ufffdn\ufffd\ufffd\ufffd \ufffdg\ufffdc;\ufffd\ufffdl\ufffd\ufffdC*\ufffd\ufffdw0\ufffdT\ufffd\ufffdL\ufffd\ufffd,\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "personal_agent", "service_banner": "honeypot-personal-agent", "service_os": "linux", "dst_port": "5555" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 99, "port_scan_ports_sample": [ 1001, 1029, 2001, 2002, 3001, 4001, 4050, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014, 5015 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 99, "scan_velocity_ports_per_s": 146.08, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 17, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "sip-tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	1040 · TLS	tls	Scan de ports port scan syn · via TLS:1040 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1040 Chemin / cible — Service TLS Payload ��i,}Ȕiav� >�6��=�3"��w�0� ��#̏�0�kӳiQ��l����>i9��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��i,}Ȕiav� >�6��=�3"��w�0� ��#̏�0�kӳiQ��l����>i9��+�/�,�0̨̩� �� _� Requête brute (extrait) ��i,}Ȕiav� >�6��=�3"��w�0� ��#̏�0�kӳiQ��l����>i9��+�/�,�0̨̩� �� _ � � 2+ 3��pLfu�v�㜃��eP�P��!�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.725482939781331, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 1040, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "18386ffc88b03e2804ce75a6784af86a5a8405ce", "event_fingerprint": "31e327b68ebff033eb14116a162510fb8ec86a07", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "09d5e99a7f257d80869a75ec39885d26", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1040, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\u001a\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd\b0\ufffd\r\u0012 \ufffd\u0003\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\u0005\u0007\ufffd\ufffd\ufffd\ufffd>i\u00129\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\u001a\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd\b0\ufffd\r\u0012 \ufffd\u0003\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\u0005\u0007\ufffd\ufffd\ufffd\ufffd>i\u00129\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdpLfu\ufffdv\ufffd\u3703\ufffd\ufffdeP\ufffd\u0007P\u0017\ufffd\ufffd!\ufffd\u0012\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\u001a\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd\b0\ufffd\r\u0012 \ufffd\u0003\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\u0005\u0007\ufffd\ufffd\ufffd\ufffd>i\u00129\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "daec76c307ddef95d7d162c2ae47263cb64a5f36", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\u001a\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd\b0\ufffd\r\u0012 \ufffd\u0003\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\u0005\u0007\ufffd\ufffd\ufffd\ufffd>i\u00129\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 1040, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd0\ufffd\r \ufffd\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd>i9\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:1040 \u00b7 (reconnaissance)", "target_port_label": "1040 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (17 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1040, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\u001a\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd\b0\ufffd\r\u0012 \ufffd\u0003\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\u0005\u0007\ufffd\ufffd\ufffd\ufffd>i\u00129\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 1040, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:1040 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi,}\u0214iav\ufffd\n>\ufffd6\ufffd\ufffd=\ufffd3\"\ufffd\ufffd\ufffdw\ufffd0\ufffd\r \ufffd\ufffd#\u030f\ufffd0\ufffdk\u04f3iQ\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd>i9\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "1040 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 100, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 4001, 4050, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 100, "scan_velocity_ports_per_s": 146.1, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 17, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "sip-tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	6070 · TLS	tls	Scan de ports port scan syn · via TLS:6070 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6070 Chemin / cible — Service TLS Payload ��#�!��4'ʎ6ֽ�܎�fv�x�Y<�@p ��\|�{�;vD�J��q][ͣ��}D4��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��#�!��4'ʎ6ֽ�܎�fv�x�Y<�@p ��\|�{�;vD�J��q][ͣ��}D4��+�/�,�0̨̩� �� _� Requête brute (extrait) ��#�!��4'ʎ6ֽ�܎�fv�x�Y<�@p ��\|�{�;vD�J��q][ͣ��}D4��+�/�,�0̨̩� �� _ � � 2+ 3��&��X�s_�O�f�pR�V2�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.741054625329828, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 6070, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "977e8838e531dd417aa38b4bdc43169c6da3fd98", "event_fingerprint": "7f2418e7941f6fd520428d101a598319d2bd409a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "8c004fbb317f09e02ccd790af07faf4e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6070, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd#\u0001\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\u001a\ufffdfv\ufffd\u0007x\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\u0017\ufffd;vD\ufffdJ\u0001\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\u0011\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd#\u0001\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\u001a\ufffdfv\ufffd\u0007x\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\u0017\ufffd;vD\ufffdJ\u0001\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\u0011\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd&\ufffd\ufffd\ufffdX\ufffd\u0017s_\ufffd\u0016O\ufffdf\u0004\ufffdpR\u0019\ufffdV2\ufffd\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd#\u0001\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\u001a\ufffdfv\ufffd\u0007x\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\u0017\ufffd;vD\ufffdJ\u0001\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\u0011\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cde5c900cd67d29e2afa422df4a5fc7c14fc8551", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd#\u0001\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\u001a\ufffdfv\ufffd\u0007x\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\u0017\ufffd;vD\ufffdJ\u0001\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\u0011\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6070, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd#\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\ufffdfv\ufffdx\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\ufffd;vD\ufffdJ\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:6070 \u00b7 (reconnaissance)", "target_port_label": "6070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (17 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6070, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd#\u0001\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\u001a\ufffdfv\ufffd\u0007x\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\u0017\ufffd;vD\ufffdJ\u0001\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\u0011\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 6070, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:6070 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd#\ufffd!\ufffd\ufffd4'\u028e6\u05bd\ufffd\u070e\ufffdfv\ufffdx\ufffdY<\ufffd@p \t\ufffd\ufffd\ufffd\|\ufffd{\ufffd;vD\ufffdJ\ufffd\ufffdq][\u0363\ufffd\ufffd\ufffd}D4\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "6070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 101, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 4001, 4050, 4758, 5001, 5002, 5010, 5011, 5012, 5013, 5014 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 101, "scan_velocity_ports_per_s": 146.1, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 17, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "sip-tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	4070 · TLS	tls	Scan de ports port scan syn · via TLS:4070 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4070 Chemin / cible — Service TLS Payload ��1$��,!W��9��͸Y�\�'�s� s�9�c�� Zϑ�l�P?�Db2 �G ��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��1$��,!W��9��͸Y�\�'�s� s�9�c�� Zϑ�l�P?�Db2 �G ��+�/�,�0̨̩� �� _� Requête brute (extrait) ��1$��,!W��9��͸Y�\�'�s� s�9�c�� Zϑ�l�P?�Db2 �G ��+�/�,�0̨̩� �� _ � � 2+ 3��3ʉ�;�vYoT�xP�rXq�+ Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.690795915847147, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 4070, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "2f5545317096dbb7ef857257daea66a9739a71ec", "event_fingerprint": "2415e12bc5ea18a236db56e213b9eb982f403ebb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "d2dc8b619989a0aa3d0bd8f09ebe6d5d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 4070, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00031$\ufffd\ufffd\ufffd,!W\ufffd\u0012\ufffd\u0017\ufffd\ufffd9\ufffd\u0013\ufffd\ufffd\u0378\u001eY\ufffd\\\ufffd'\ufffd\u001cs\ufffd\f s\u0005\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\u000e\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00031$\ufffd\ufffd\ufffd,!W\ufffd\u0012\ufffd\u0017\ufffd\ufffd9\ufffd\u0013\ufffd\ufffd\u0378\u001eY\ufffd\\\ufffd'\ufffd\u001cs\ufffd\f s\u0005\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\u000e\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd3\u0289\ufffd;\ufffdvYo\u0003\u0005T\ufffdxP\ufffdr\u0017Xq\u0012\ufffd+", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00031$\ufffd\ufffd\ufffd,!W\ufffd\u0012\ufffd\u0017\ufffd\ufffd9\ufffd\u0013\ufffd\ufffd\u0378\u001eY\ufffd\\\ufffd'\ufffd\u001cs\ufffd\f s\u0005\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\u000e\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "023346f15289858d54fa8b495cbe44b9261e0f86", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00031$\ufffd\ufffd\ufffd,!W\ufffd\u0012\ufffd\u0017\ufffd\ufffd9\ufffd\u0013\ufffd\ufffd\u0378\u001eY\ufffd\\\ufffd'\ufffd\u001cs\ufffd\f s\u0005\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\u000e\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 4070, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd1$\ufffd\ufffd\ufffd,!W\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd\u0378Y\ufffd\\\ufffd'\ufffds\ufffd s\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:4070 \u00b7 (reconnaissance)", "target_port_label": "4070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (17 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4070, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00031$\ufffd\ufffd\ufffd,!W\ufffd\u0012\ufffd\u0017\ufffd\ufffd9\ufffd\u0013\ufffd\ufffd\u0378\u001eY\ufffd\\\ufffd'\ufffd\u001cs\ufffd\f s\u0005\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\u000e\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 4070, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:4070 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd1$\ufffd\ufffd\ufffd,!W\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd\u0378Y\ufffd\\\ufffd'\ufffds\ufffd s\ufffd9\ufffdc\ufffd\ufffd\t\ufffd\ufffd\ufffdZ\u03d1\ufffdl\ufffdP?\ufffdDb2\t\ufffdG\t\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "4070 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 102, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 4001, 4050, 4070, 4758, 5001, 5002, 5010, 5011, 5012, 5013 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 102, "scan_velocity_ports_per_s": 146.04, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 17, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "sip-tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	3060 · TLS	tls	Scan de ports port scan syn · via TLS:3060 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3060 Chemin / cible — Service TLS Payload ��Y��1�Ġ�A\|LH�? cu ��x�U� ��5c�D�_�O��`p4�Qڲ��'aa�]�kH�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y��1�Ġ�A\|LH�? cu��x�U� ��5c�D�_�O��`p4�Qڲ��'aa�]�kH�+�/�,�0̨̩� �� _� Requête brute (extrait) ��Y��1�Ġ�A\|LH�? cu ��x�U� ��5c�D�_�O��`p4�Qڲ��'aa�]�kH�+�/�,�0̨̩� �� _ � � 2+ 3��n~�F`�z��qPp��%ţ� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.727747536465854, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 3060, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4b02f9ace76926f05ec5b951ae0cb1621c24f1cb", "event_fingerprint": "3f388836a9ec509445e65a3bb6b17e83d8bafbcd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "0f91d26616869ffe22bc5351584c6107", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3060, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd\ufffd\u0000\ufffd\ufffd1\u001c\ufffd\u0120\ufffdA\|L\u0013H\ufffd?\rcu\u000b\ufffd\ufffd\ufffdx\ufffdU\u0007\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\u0013\ufffd\u0004kH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd\ufffd\u0000\ufffd\ufffd1\u001c\ufffd\u0120\ufffdA\|L\u0013H\ufffd?\rcu\u000b\ufffd\ufffd\ufffdx\ufffdU\u0007\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\u0013\ufffd\u0004kH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdn~\u0019\ufffdF\u0011`\ufffdz\ufffd\ufffd\ufffdqPp\ufffd\ufffd\ufffd%\u0163\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd\ufffd\u0000\ufffd\ufffd1\u001c\ufffd\u0120\ufffdA\|L\u0013H\ufffd?\rcu\u000b\ufffd\ufffd\ufffdx\ufffdU\u0007\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\u0013\ufffd\u0004kH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ff12e3c581ba66875244eff4f9d8b11542dc187", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd\ufffd\u0000\ufffd\ufffd1\u001c\ufffd\u0120\ufffdA\|L\u0013H\ufffd?\rcu\u000b\ufffd\ufffd\ufffdx\ufffdU\u0007\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\u0013\ufffd\u0004kH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 3060, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd1\ufffd\u0120\ufffdA\|LH\ufffd?\rcu\ufffd\ufffd\ufffdx\ufffdU\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\ufffdkH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:3060 \u00b7 (reconnaissance)", "target_port_label": "3060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (17 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3060, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd\ufffd\u0000\ufffd\ufffd1\u001c\ufffd\u0120\ufffdA\|L\u0013H\ufffd?\rcu\u000b\ufffd\ufffd\ufffdx\ufffdU\u0007\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\u0013\ufffd\u0004kH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 3060, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:3060 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd1\ufffd\u0120\ufffdA\|LH\ufffd?\rcu\ufffd\ufffd\ufffdx\ufffdU\ufffd \ufffd\ufffd5c\ufffdD\ufffd_\ufffdO\ufffd\ufffd`p4\ufffdQ\u06b2\ufffd\ufffd'aa\ufffd]\ufffdkH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "3060 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 103, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 3060, 4001, 4050, 4070, 4758, 5001, 5002, 5010, 5011, 5012 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 103, "scan_velocity_ports_per_s": 146.11, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 17, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "sip-tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	4000 · REMOTEANYTHING	remoteanything	Scan de ports port scan syn · via REMOTEANYTHING:4000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur REMOTEANYTHING WAF — Recommandation Surveiller Tags net_port_scan_fast tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4000 Chemin / cible — Service REMOTEANYTHING Payload ��/l� ]1��ֽak� �_T��G�d�{ yMf��}�@�m��nҤ�i{& �3��U�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��/l� ]1��ֽak� �_T��G�d�{ yMf��}�@�m��nҤ�i{& �3��U�+�/�,�0̨̩� �� _� Requête brute (extrait) ��/l� ]1��ֽak� �_T��G�d�{ yMf��}�@�m��nҤ�i{& �3��U�+�/�,�0̨̩� �� _ � � 2+ 3��yzTTOWV�p�\|1Ӗ�;^ Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a", "emulator_response_len": 45, "bytes_in": 1483, "payload_entropy": 7.701102558794185, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "remoteanything", "app_proto": "remoteanything", "asn": 23470, "country": "HK", "dst_port": 4000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "36ae3f4c8cacdf1ea47fa080288c7f9a84dcfd7f", "event_fingerprint": "7efabdbca5bf0f016f426b45f2c65d538f330e51", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "remoteanything", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "85c850a1ed0548378df0a14c6cc9071d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 4000, "service": "remoteanything", "service_name": "remoteanything", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\u0006\ufffd\t\ufffd\u0000\u0001_\u0012T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\b\ufffdn\u001e\u04a4\ufffdi{&\t\r\ufffd3\ufffd\u0010\ufffd\ufffdU\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\u0006\ufffd\t\ufffd\u0000\u0001_\u0012T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\b\ufffdn\u001e\u04a4\ufffdi{&\t\r\ufffd3\ufffd\u0010\ufffd\ufffdU\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdyzT\u0007TOWV\ufffd\u0018p\u0012\ufffd\|1\u0015\u04d6\ufffd;\u0006^", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\u0006\ufffd\t\ufffd\u0000\u0001_\u0012T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\b\ufffdn\u001e\u04a4\ufffdi{&\t\r\ufffd3\ufffd\u0010\ufffd\ufffdU\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "777bb5cd50fa332fb23e6f2b4c628c9cbd04c90f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\u0006\ufffd\t\ufffd\u0000\u0001_\u0012T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\b\ufffdn\u001e\u04a4\ufffdi{&\t\r\ufffd3\ufffd\u0010\ufffd\ufffdU\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 4000, "service": "remoteanything", "service_label_fr": "REMOTEANYTHING" }, "evidence_snippet": "\ufffd\ufffd\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\ufffd\t\ufffd_T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\ufffdn\u04a4\ufffdi{&\t\r\ufffd3\ufffd\ufffd\ufffdU\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)", "target_port_label": "4000 \u00b7 REMOTEANYTHING", "emulator_service": "remoteanything", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REMOTEANYTHING \u2014 multi-protocole (18 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "remoteanything", "service_label_fr": "REMOTEANYTHING", "dst_port": 4000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-remoteanything", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\u0006\ufffd\t\ufffd\u0000\u0001_\u0012T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\b\ufffdn\u001e\u04a4\ufffdi{&\t\r\ufffd3\ufffd\u0010\ufffd\ufffdU\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 4000, "service": "remoteanything", "service_label_fr": "REMOTEANYTHING" }, "attack_vector": "port scan syn \u00b7 via REMOTEANYTHING:4000 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\/l\ufffd\r]1\ufffd\ufffd\ufffd\u05bdak\ufffd\t\ufffd_T\ufffd\ufffd\ufffdG\ufffdd\ufffd{ yMf\ufffd\ufffd\ufffd\ufffd}\ufffd@\ufffdm\ufffd\ufffdn\u04a4\ufffdi{&\t\r\ufffd3\ufffd\ufffd\ufffdU\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "4000 \u00b7 REMOTEANYTHING", "emulator_service": "remoteanything", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "remoteanything", "service_banner": "honeypot-remoteanything", "service_os": "linux", "dst_port": "4000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 104, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 3060, 4000, 4001, 4050, 4070, 4758, 5001, 5002, 5010, 5011 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 104, "scan_velocity_ports_per_s": 146.18, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 18, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "remoteanything" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_clienthello" ] }
25/07/2026 18:28:56 UTC	TCP	7080 · TLS	tls	Scan de ports port scan syn · via TLS:7080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_port_scan_fast tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7080 Chemin / cible — Service TLS Payload ��W㙤�7� 3Ƨ��z ��䲋��OIV�Y(Gfi� �x��u��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��W㙤�7� 3Ƨ��z ��䲋��OIV�Y(Gfi��x��u��+�/�,�0̨̩� �� _� Requête brute (extrait) ��W㙤�7� 3Ƨ��z ��䲋��OIV�Y(Gfi� �x��u��+�/�,�0̨̩� �� _ � � 2+ 3��e�3��4�ꉅtF�9!3�9nP�v� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.7095688034502885, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 7080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0af962b45185fc68f5db7bf5abbca4cd2e2fcfbc", "event_fingerprint": "45b48cdc2563814a1650b0c43210ddde17166b1e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "c95de28288b227b20d21eca920a9a03f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 7080, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffdW\u3664\ufffd\u00137\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \u001e\ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\u000b\ufffd\u0018x\ufffd\ufffd\ufffdu\u0000\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffdW\u3664\ufffd\u00137\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \u001e\ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\u000b\ufffd\u0018x\ufffd\ufffd\ufffdu\u0000\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffde\ufffd3\ufffd\ufffd4\ufffd\ua245tF\ufffd9!3\ufffd9nP\ufffdv\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffdW\u3664\ufffd\u00137\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \u001e\ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\u000b\ufffd\u0018x\ufffd\ufffd\ufffdu\u0000\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2460596bf42426e10a30a1f60519c6701248b024", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffdW\u3664\ufffd\u00137\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \u001e\ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\u000b\ufffd\u0018x\ufffd\ufffd\ufffdu\u0000\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7080, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdW\u3664\ufffd7\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\ufffdx\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:7080 \u00b7 (reconnaissance)", "target_port_label": "7080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (18 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7080, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffdW\u3664\ufffd\u00137\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \u001e\ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\u000b\ufffd\u0018x\ufffd\ufffd\ufffdu\u0000\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7080, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:7080 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdW\u3664\ufffd7\ufffd\n3\u01a7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz \ufffd\ufffd\u4c8b\ufffd\ufffd\ufffd\ufffd\ufffdOIV\ufffdY(Gfi\ufffd\ufffdx\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "7080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 105, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 3060, 4000, 4001, 4050, 4070, 4758, 5001, 5002, 5010, 5011 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 105, "scan_velocity_ports_per_s": 146.13, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 18, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "remoteanything" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:56 UTC	TCP	5060 · SIP	sip	Scan de ports port scan syn · via SIP:5060 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SIP WAF — Recommandation Surveiller Tags net_port_scan_fast sip_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5060 Chemin / cible — Service SIP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d", "emulator_response_len": 215, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip", "app_proto": "sip", "asn": 23470, "country": "HK", "dst_port": 5060, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b49cfdb3b83c9ca67d4796f112820f5181e9e4f5", "event_fingerprint": "98c5272f4f6c6dc508679b7c4253902b2a7230a2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "sip", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5060, "service": "sip", "service_name": "sip", "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ddbd6d4aa7daa90790db742611cc622be53f37f", "protocol_details": { "port": 5060, "service": "sip", "service_label_fr": "SIP" }, "attack_vector": "port scan syn \u00b7 via SIP:5060 \u00b7 (reconnaissance)", "target_port_label": "5060 \u00b7 SIP", "emulator_service": "sip", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SIP \u2014 multi-protocole (19 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "sip", "service_label_fr": "SIP", "dst_port": 5060, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "port": 5060, "service": "sip", "service_label_fr": "SIP" }, "attack_vector": "port scan syn \u00b7 via SIP:5060 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "5060 \u00b7 SIP", "emulator_service": "sip", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip", "service_banner": "honeypot-sip", "service_os": "linux", "dst_port": "5060" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 106, "port_scan_ports_sample": [ 1001, 1029, 1040, 2001, 2002, 3001, 3060, 4000, 4001, 4050, 4070, 4758, 5001, 5002, 5010, 5011 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 106, "scan_velocity_ports_per_s": 147.06, "multi_category_scan": true, "scan_category_diversity": [ "cloud", "telecom" ], "multi_protocol_correlation": true, "multi_protocol_count": 19, "multi_protocol_sample": [ "grafana", "http-alt-8001", "kafka-ssl", "minio-console", "nomad-http", "oracle-em", "personal-agent", "remoteanything" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "sip_emulated" ] }
25/07/2026 18:28:55 UTC	TCP	5061 · SIP TLS	sip-tls	Sonde SIP/VoIP sip voip probe · via SIP TLS:5061 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SIP-TLS WAF — Recommandation Surveiller Tags net_sip_voip_probe sip_tls_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5061 Chemin / cible — Service SIP TLS Payload ��0�z�0;�P��[��n�k)e�BJ�ÔW�� Xnr� �~��!� �v�lB��OOAf�/�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67% Confiance classification 67% Risque capteur Moyen · 45 Confiance : Confiance 67 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0578 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��0�z�0;�P��[��n�k)e�BJ�ÔW�� Xnr� �~��!� �v�lB��OOAf�/�+�/�,�0̨̩� �� _� Requête brute (extrait) ��0�z�0;�P��[��n�k)e�BJ�ÔW�� Xnr� �~��!� �v�lB��OOAf�/�+�/�,�0̨̩� �� _ � � 2+ 3��3c�"��b/�hx\|͜�L�Tj Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 1483, "payload_entropy": 7.721929585332608, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "sip-tls", "app_proto": "sip-tls", "asn": 23470, "country": "HK", "dst_port": 5061, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a", "event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294", "classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 75, "precision_signals": [ "pat-0578", "INT-upstream" ], "kb_rule_ids": [ "pat-0578", "INT-upstream" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "sip-tls", "risk_confidence_factor": 67, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "317aefd5c160e3883f00d2b46da98b26", "path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c" }, "target_context": { "dst_port": 5061, "service": "sip-tls", "service_name": "sip-tls", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\u001b\ufffdB\u0013J\u0004\ufffd\u00d4W\ufffd\ufffd \ufffdX\u001dnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\u0012\ufffdlB\ufffd\ufffd\u001a\ufffdO\u0013OAf\ufffd\/\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\u001b\ufffdB\u0013J\u0004\ufffd\u00d4W\ufffd\ufffd \ufffdX\u001dnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\u0012\ufffdlB\ufffd\ufffd\u001a\ufffdO\u0013OAf\ufffd\/\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd3\u0010c\ufffd\"\ufffd\ufffd\u0019\ufffdb\/\ufffdhx\u0013\u001b\|\u035c\ufffdL\ufffdTj", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\u001b\ufffdB\u0013J\u0004\ufffd\u00d4W\ufffd\ufffd \ufffdX\u001dnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\u0012\ufffdlB\ufffd\ufffd\u001a\ufffdO\u0013OAf\ufffd\/\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "79a9fa7156d25fda28b815eadaac6e48a6ca3137", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\u001b\ufffdB\u0013J\u0004\ufffd\u00d4W\ufffd\ufffd \ufffdX\u001dnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\u0012\ufffdlB\ufffd\ufffd\u001a\ufffdO\u0013OAf\ufffd\/\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\ufffdBJ\ufffd\u00d4W\ufffd\ufffd \ufffdXnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\ufffdlB\ufffd\ufffd\ufffdOOAf\ufffd\/\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%", "classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 67, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "sip-tls", "service_label_fr": "SIP TLS", "dst_port": 5061, "protocol_emulated": true, "tags_summary": [ "pat-0578", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0578", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sip-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\u001b\ufffdB\u0013J\u0004\ufffd\u00d4W\ufffd\ufffd \ufffdX\u001dnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\u0012\ufffdlB\ufffd\ufffd\u001a\ufffdO\u0013OAf\ufffd\/\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 5061, "service": "sip-tls", "service_label_fr": "SIP TLS" }, "attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd0\ufffdz\ufffd0;\ufffdP\ufffd\ufffd\ufffd[\ufffd\ufffdn\ufffdk)e\ufffdBJ\ufffd\u00d4W\ufffd\ufffd \ufffdXnr\ufffd \ufffd~\ufffd\ufffd!\ufffd\t\ufffdv\ufffdlB\ufffd\ufffd\ufffdOOAf\ufffd\/\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5061 \u00b7 SIP TLS", "emulator_service": "sip-tls", "confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sip_tls", "service_banner": "honeypot-sip-tls", "service_os": "linux", "dst_port": "5061" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_sip_voip_probe", "sip_tls_emulated", "tls_clienthello" ] }
25/07/2026 18:28:55 UTC	TCP	5066 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:5066 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5066 Chemin / cible — Service TLS Payload ��֒c��F�e�͹jpN�/�>jK��i �M,�U옘�E[�dr� �K�l^R5Zg��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��֒c��F�e�͹jpN�/�>jK��i �M,�U옘�E[�dr� �K�l^R5Zg��+�/�,�0̨̩� �� _� Requête brute (extrait) ��֒c��F�e�͹jpN�/�>jK��i �M,�U옘�E[�dr� �K�l^R5Zg��+�/�,�0̨̩� �� _ � � 2+ 3��I aa�x54P��v��$��&A Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.741052589359774, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5066, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e0e04ec1540100bb296603a2707d425c94134df4", "event_fingerprint": "147dfa74807526eb31f4a94819b1aab55c08646c", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "241c7fa4b0bf224adf98eff1fcd70f7b", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 5066, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0592c\u0010\ufffd\u000e\ufffdF\ufffd\u0010e\u0015\ufffd\u0379jpN\ufffd\/\u0000\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\u0017\ufffddr\ufffd\n\u0003\u0015\ufffdK\u0019\ufffdl^R5Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0592c\u0010\ufffd\u000e\ufffdF\ufffd\u0010e\u0015\ufffd\u0379jpN\ufffd\/\u0000\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\u0017\ufffddr\ufffd\n\u0003\u0015\ufffdK\u0019\ufffdl^R5Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0011I\taa\ufffdx54P\ufffd\ufffdv\ufffd\ufffd\u0015$\ufffd\ufffd\ufffd\ufffd\u0014&A", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0592c\u0010\ufffd\u000e\ufffdF\ufffd\u0010e\u0015\ufffd\u0379jpN\ufffd\/\u0000\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\u0017\ufffddr\ufffd\n\u0003\u0015\ufffdK\u0019\ufffdl^R5Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "629bb7ee021d02c1a6d8248915305150f5e938bf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0592c\u0010\ufffd\u000e\ufffdF\ufffd\u0010e\u0015\ufffd\u0379jpN\ufffd\/\u0000\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\u0017\ufffddr\ufffd\n\u0003\u0015\ufffdK\u0019\ufffdl^R5Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u0592c\ufffd\ufffdF\ufffde\ufffd\u0379jpN\ufffd\/\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\ufffddr\ufffd\n\ufffdK\ufffdl^R5Zg\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:5066 \u00b7 (sonde \/ probe)", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5066, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0592c\u0010\ufffd\u000e\ufffdF\ufffd\u0010e\u0015\ufffd\u0379jpN\ufffd\/\u0000\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\u0017\ufffddr\ufffd\n\u0003\u0015\ufffdK\u0019\ufffdl^R5Zg\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5066, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:5066 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u0592c\ufffd\ufffdF\ufffde\ufffd\u0379jpN\ufffd\/\ufffd>jK\ufffd\ufffdi \ufffdM,\ufffdU\uc618\ufffdE[\ufffddr\ufffd\n\ufffdK\ufffdl^R5Zg\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5066 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5066" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
25/07/2026 18:28:55 UTC	TCP	5062 · TLS	tls	Scan de ports port scan syn · via TLS:5062 · (reconnaissance)	Moyenne	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5062 Chemin / cible — Service TLS Payload ��F�G�4�@)&zs�%��zF�"ϗp~��7M ph�s�':��rAxc�H��1��.��t��2�+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��F�G�4�@)&zs�%��zF�"ϗp~��7M ph�s�':��rAxc�H��1��.��t��2�+�/�,�0̨̩� �� _� Requête brute (extrait) ��F�G�4�@)&zs�%��zF�"ϗp~��7M ph�s�':��rAxc�H��1��.��t��2�+�/�,�0̨̩� �� _ � � 2+ 3��!V��&�َ�#L�:�9��m Q� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.746141595457779, "port_category": "registered", "org": "ReliableSite.Net LLC", "service": "tls", "app_proto": "tls", "asn": 23470, "country": "HK", "dst_port": 5062, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0286275e963ecbba25e4ad0126ca88959d378b70", "event_fingerprint": "d07f2090b3880700da5d0d0553987731382efcaa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "HK", "asn": 23470, "org": "ReliableSite.Net LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "1f7d64aea7981369c7dec71baf6cc820", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5062, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\u0005\ufffd%\ufffd\ufffdzF\ufffd\"\u0019\u03d7p~\ufffd\ufffd\ufffd7M \bph\ufffds\ufffd':\ufffd\u0014\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\u0002\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\u0005\ufffd%\ufffd\ufffdzF\ufffd\"\u0019\u03d7p~\ufffd\ufffd\ufffd7M \bph\ufffds\ufffd':\ufffd\u0014\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\u0002\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd!V\ufffd\ufffd&\ufffd\u064e\ufffd#L\ufffd:\ufffd9\ufffd\u0011\ufffdm\tQ\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\u0005\ufffd%\ufffd\ufffdzF\ufffd\"\u0019\u03d7p~\ufffd\ufffd\ufffd7M \bph\ufffds\ufffd':\ufffd\u0014\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\u0002\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3bc0835e129ff61577d0cc645a0ebe713c89e7f6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\u0005\ufffd%\ufffd\ufffdzF\ufffd\"\u0019\u03d7p~\ufffd\ufffd\ufffd7M \bph\ufffds\ufffd':\ufffd\u0014\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\u0002\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\ufffd%\ufffd\ufffdzF\ufffd\"\u03d7p~\ufffd\ufffd\ufffd7M ph\ufffds\ufffd':\ufffd\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5062, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\u0005\ufffd%\ufffd\ufffdzF\ufffd\"\u0019\u03d7p~\ufffd\ufffd\ufffd7M \bph\ufffds\ufffd':\ufffd\u0014\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\u0002\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 5062, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:5062 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdF\ufffdG\ufffd4\ufffd@)&zs\ufffd%\ufffd\ufffdzF\ufffd\"\u03d7p~\ufffd\ufffd\ufffd7M ph\ufffds\ufffd':\ufffd\ufffd\ufffd\ufffdrAxc\ufffdH\ufffd\ufffd1\ufffd\ufffd.\ufffd\ufffdt\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "5062 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5062" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sip-tls", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }

185.243.5.8

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence