|
|
TCP |
5079 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5079 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5079
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=8985d Call-ID: 94c3b99a9dd4459d85b32920e29a160e CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.486058354074591,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5079,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ca0ec8f64d1dd1bdc1c9892c056d397ed3e1055a",
"event_fingerprint": "a7072d7f6ac57909738ed5f9032db030e6491c3c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "9704953717acac284bf1a9c5f6984ad1",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5079,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=8985d\r\nCall-ID: 94c3b99a9dd4459d85b32920e29a160e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=8985d\r\nCall-ID: 94c3b99a9dd4459d85b32920e29a160e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc37304533ae571424ccb85f10bef4b773d25811",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5079,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5079,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5079 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5079;branch=z9hG4bK79e9b9bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5079 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5079"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 18,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5078 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5078 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5078
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=79cda Call-ID: c28a506c399a47bc972a1bc202af320e CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.442208221775633,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5078,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "611e8d3206647a9625d70592482baad548fd0da6",
"event_fingerprint": "1ac95fa800165bce62f9e1200a9a701ab9246f59",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "9a980973c5f05da482aa085b7270c2f5",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5078,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=79cda\r\nCall-ID: c28a506c399a47bc972a1bc202af320e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=79cda\r\nCall-ID: c28a506c399a47bc972a1bc202af320e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc15d34aa711eede9ab77dc1c5ba6445d569b8e1",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5078,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5078 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5078;branch=z9hG4bK712ea4d7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 17,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5075 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5075 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5075
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=3491f Call-ID: 5a0df086160d4c5084aec2260ba54598 CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.453870090692852,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5075,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "93291295b227160835a9f78bb0f8351d45e1fe32",
"event_fingerprint": "3e64d544b8917f6e7ccea7bdccf9136c4fe77f7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "d2e0e8729ec1d1637bc7b4069f4e4b4d",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5075,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3491f\r\nCall-ID: 5a0df086160d4c5084aec2260ba54598\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=3491f\r\nCall-ID: 5a0df086160d4c5084aec2260ba54598\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81afd3eed8a9bf8854494759d7587e5176a0940f",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5075,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5075,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5075 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5075;branch=z9hG4bK50d8a5c2\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5075 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5075"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 16,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074,
5075
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5074 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5074 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5074
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=69b1c Call-ID: 8be670aaf7b4454ab1b142aa05d5d226 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.477368410616853,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5074,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f1802749b3af9d8de7aa80026f502407679ad9ee",
"event_fingerprint": "96089a1cfe435612e66909c841f3815d082086bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "7f16abd31d6286897ecfbb5353736e2b",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5074,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69b1c\r\nCall-ID: 8be670aaf7b4454ab1b142aa05d5d226\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69b1c\r\nCall-ID: 8be670aaf7b4454ab1b142aa05d5d226\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "049a5bcfdd194ca8479ed20fa0d9fb9e3fbbce77",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5074,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5074,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5074 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5074;branch=z9hG4bKe31464e8\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5074 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5074"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073,
5074
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5073 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5073 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5073
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=b5c40 Call-ID: c0b966f8336b422b8db2ef1d5f8d618e CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.489443358752779,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5073,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4ffb4091b99ebb769e7bfd61bc52013b27ac5c99",
"event_fingerprint": "93d3904901ed14a8863a7f3a2f67028400f06750",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "6b975e86cbac14215356ce7a340f20e8",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5073,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b5c40\r\nCall-ID: c0b966f8336b422b8db2ef1d5f8d618e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b5c40\r\nCall-ID: c0b966f8336b422b8db2ef1d5f8d618e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1676972e6192be5f2a97c33a05994a684f82633c",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5073,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5073,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5073 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5073;branch=z9hG4bK3de02387\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5073 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072,
5073
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5072 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5072 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5072
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=4fc27 Call-ID: 91e7677fbdc4413784d3ebd48ca0933a CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.458804147802893,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5072,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "85aa1b0bc2eb9201f8936d0eb19709fcfb23b9b3",
"event_fingerprint": "bd48e15f882f1edcc690e6cb906daa92796ca567",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "462fa2d40f0d2a87fa0da7cb19037590",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5072,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4fc27\r\nCall-ID: 91e7677fbdc4413784d3ebd48ca0933a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=4fc27\r\nCall-ID: 91e7677fbdc4413784d3ebd48ca0933a\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e6cc9ea41030f99311bebe6da6ea7cc331181da",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5072,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5072,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5072 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5072;branch=z9hG4bK05f80cac\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5072 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5072"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071,
5072
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5071 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5071 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5071
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=cf433 Call-ID: e5797e91a3604003ae08d121c9ceb1db CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.448740693973408,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5071,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "236c3ffe62fe57737c5d76a07e28b7ed340df38f",
"event_fingerprint": "5d0685defacb30a86e1f3b370655d74019cad2ce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "4c580991787170735062b2d7d2b8e64f",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5071,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=cf433\r\nCall-ID: e5797e91a3604003ae08d121c9ceb1db\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=cf433\r\nCall-ID: e5797e91a3604003ae08d121c9ceb1db\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5e7aa3cda0f4ce37943f4e7ab9e7adf78e6c849",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5071,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5071 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5071;branch=z9hG4bK59936fe7\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5071 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070,
5071
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5069 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5069 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5069
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=0f6b7 Call-ID: 57ad82cf39cd41bea5b3a462c9184c9e CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.514761451442929,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5069,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "11de6d03eb72631fbe41b7d6bfe2f97170e833de",
"event_fingerprint": "cc9be49bbdb168a7807a203ccfe4e70deb0f8c52",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "c9d5ecda80accc340e21293fec562ca4",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5069,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0f6b7\r\nCall-ID: 57ad82cf39cd41bea5b3a462c9184c9e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=0f6b7\r\nCall-ID: 57ad82cf39cd41bea5b3a462c9184c9e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37965741f5a8d8f6775e01e37ee8d55de5c64d00",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5069,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5069,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5069 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5069;branch=z9hG4bK85d92ea3\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5069 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5068 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5068 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5068
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=aff47 Call-ID: ccf5e1c5d8d843909b535927b7860090 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.470384560476459,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5068,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c106b573c520f908defb652bfc167601572455df",
"event_fingerprint": "951aed35c664e9755050097285242634ddc5291c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "d64b0be84bdc9f4f205fcdf67201f661",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5068,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=aff47\r\nCall-ID: ccf5e1c5d8d843909b535927b7860090\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=aff47\r\nCall-ID: ccf5e1c5d8d843909b535927b7860090\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da0c70a1fd8e5b021c110a4831374724f50d4a7f",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5068 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5068;branch=z9hG4bK2c227a97\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5067 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5067 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5067
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=dbf33 Call-ID: 60af49b0a91645f994e753de8560e129 CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.470649910951099,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b4ae4235d43e27aa913bf24c76fff82585ea21d8",
"event_fingerprint": "d0e49d5b45f2786f1d83de519fa549de821650fb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "07fa92784d9f6cc3e93e34fd702f74fe",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5067,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=dbf33\r\nCall-ID: 60af49b0a91645f994e753de8560e129\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=dbf33\r\nCall-ID: 60af49b0a91645f994e753de8560e129\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfb7bd25625cff265cbd889df6119cdea16688a0",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5067,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5067 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5067;branch=z9hG4bK5de1dc36\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5067 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5066 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5066 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Cisco-CP7841/11.5.1
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5066
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Cisco-CP7841/11.5.1
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=73833 Call-ID: 23534ef0884f433c858945f21f2254e3 CSeq: 1 OPTIONS User-Agent: Cisco-CP7841/11.5.1 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "c36821bd0e055467034b000d1ce9d971641e3c7a",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.438664524357506,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "673091ace144c9cd261f81cee229edbccf22ffc5",
"event_fingerprint": "2532f199ab6fb310cb3f4a5cb1eec9dad2fe556e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39ced5f8a6dcbdbdb11ff29912c4259b",
"payload_hash": "f8c06e84e3b126b4579f9c8aa9f939ab",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5066,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=73833\r\nCall-ID: 23534ef0884f433c858945f21f2254e3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Cisco-CP7841\/11.5.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=73833\r\nCall-ID: 23534ef0884f433c858945f21f2254e3\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Cisco-CP7841\/11.5.1\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5958f6eb241cdb4356ea9a9d53c168d304a1e8c",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Cisco-CP7841\/11.5.1",
"port": 5066,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5066 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5066;branch=z9hG4bK5a70e829\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5066 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5066,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5065 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5065 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5065
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=b13d8 Call-ID: 64a09ca903874853af896f264742adcd CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.526340430715244,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5065,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a64af0ed402d937dfd6b61f111728ab725d02549",
"event_fingerprint": "bf8c51e199be33a3945600628fdb65301fb87323",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "ef0e2806abdefc2065f4312962300887",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5065,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b13d8\r\nCall-ID: 64a09ca903874853af896f264742adcd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=b13d8\r\nCall-ID: 64a09ca903874853af896f264742adcd\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91f2b093f86aacecc87eea486798e4327bdb5ec8",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5065,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5065,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5065 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5065;branch=z9hG4bKdc6bb6bb\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5065 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5065"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5065,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5064 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5064 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Avaya One-X Deskphone
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5064
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Avaya One-X Deskphone
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=1b4b6 Call-ID: 42be386eedf54372abc322e1e5b38fd2 CSeq: 1 OPTIONS User-Agent: Avaya One-X Deskphone Accept: appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "aa3492bf3b83c8dfd5b80724d01c9714446d9fb1",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 290,
"payload_entropy": 5.4883211101360265,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "55dd9c28bb52b627f142f8f46a04723e3e54441a",
"event_fingerprint": "6ecd8dbdf4b610f20c772b55b95a9fb13107931a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e5ff3d82e01af99131ed47ebade8f44d",
"payload_hash": "d20f08f9159c98b53ab1f169c174730c",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5064,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1b4b6\r\nCall-ID: 42be386eedf54372abc322e1e5b38fd2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Avaya One-X Deskphone",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=1b4b6\r\nCall-ID: 42be386eedf54372abc322e1e5b38fd2\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Avaya One-X Deskphone\r\nAccept: appl",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eac216523e90896f7cc93a707bf5c1665c765eef",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Avaya One-X Deskphone",
"port": 5064,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5064 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5064;branch=z9hG4bK5cf03666\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5064 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5064,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5063 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5063 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Asterisk PBX 18.2.0
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5063
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Asterisk PBX 18.2.0
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=69c11 Call-ID: 36a2de70f28d4ca199f0c851a56f521e CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "b56932018d6f8e44153f4ebf9a4aa05f0b0a8be2",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 288,
"payload_entropy": 5.481776099242981,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5063,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ef3014c2ae413cb99ea8d4323447d2a6bd4a6e0a",
"event_fingerprint": "2c44e9b548ab4b593e7b7423476000751c96f4d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3da61440911726d360b6c07932d58577",
"payload_hash": "1c9a6d42fa9e00ea74947b8c1c806a13",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5063,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69c11\r\nCall-ID: 36a2de70f28d4ca199f0c851a56f521e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Asterisk PBX 18.2.0",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=69c11\r\nCall-ID: 36a2de70f28d4ca199f0c851a56f521e\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55a8d6bba0902e5eb25bffbd27ebffcb5fa04872",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5063,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Asterisk PBX 18.2.0",
"port": 5063,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5063 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5063;branch=z9hG4bKbe76e429\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5063 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5063"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
5060,
5061,
5062,
5063,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5070 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5070 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5070
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=ba81f Call-ID: 5d7671d353be41e7b6f41ec9c073e77d CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.473394939884921,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5070,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 59,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "efebf4371d2a068359783b3d9e36e199e63b895b",
"event_fingerprint": "56c4448f115f78143fe87ec77e0301ce4dc21e2b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "0617bf30d276c7e74d96bde37181ed81",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5070,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ba81f\r\nCall-ID: 5d7671d353be41e7b6f41ec9c073e77d\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=ba81f\r\nCall-ID: 5d7671d353be41e7b6f41ec9c073e77d\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92b79cb163eb21e69602bd393e2a745bab510d91",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5070,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5070,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5070 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5070;branch=z9hG4bK9ae4861b\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5060,
5061,
5062,
5070
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5062 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5062 · (reconnaissance) · → sip:62.3.50.33
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
OPTIONS sip:62.3.50.33 UA Zoiper rv2.15.53
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950382:rce-14
950402:ssrf-2
Cible HTTP
OPTIONS
sip:62.3.50.33
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5062
Chemin / cible
sip:62.3.50.33
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
Ligne de requête
OPTIONS sip:62.3.50.33 HTTP/1.1
User-Agent
Zoiper rv2.15.53
Règles WAF
lfi-14
rce-0
rce-14
ssrf-2
nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19 To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=698fd Call-ID: 8ee0e839faa9480bab9616185d8ef8ac CSeq: 1 OPTIONS User-Agent: Zoiper rv2.15.53 Accept: applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33",
"http_ua_hash": "6651b4f64286dba367c8f17261503d1959f352e6",
"http_host_hash": null,
"http_target_hash": "a93b9fae74730e34a8148a6bdc278533115dc4a8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.479717040875289,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "http",
"app_proto": "http",
"asn": 23470,
"country": "HK",
"dst_port": 5062,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "888d6a8a205553db79660c345b8ae187b3998451",
"event_fingerprint": "e3273c3931eaa7afee757fae1577dede7fa2e7d3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340",
"pat-0384"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol"
],
"pattern_ids": [
"pat-0340",
"pat-0384"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5bb61f9762346927f1c3747d51a6fc7f",
"payload_hash": "bbe8dfd3d5f1cabeec060c277cce7d4b",
"path_pattern_hash": "54f584808f270c653072560c766be65a"
},
"target_context": {
"dst_port": 5062,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=698fd\r\nCall-ID: 8ee0e839faa9480bab9616185d8ef8ac\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"method": "OPTIONS",
"path": "sip:62.3.50.33",
"user_agent": "Zoiper rv2.15.53",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"rce-14",
"ssrf-2",
"nosqli-3"
],
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=698fd\r\nCall-ID: 8ee0e839faa9480bab9616185d8ef8ac\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Zoiper rv2.15.53\r\nAccept: applicati",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0786d446d739f42ff180f733bedb1f31eb279e35",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5062,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "OPTIONS",
"http_path": "sip:62.3.50.33",
"request_line": "OPTIONS sip:62.3.50.33 HTTP\/1.1",
"http_user_agent": "Zoiper rv2.15.53",
"port": 5062,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5062 \u00b7 (reconnaissance) \u00b7 \u2192 sip:62.3.50.33",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5062;branch=z9hG4bKeb17dd19\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5062 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5062"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950402:ssrf-2",
"950470:nosqli-3"
]
}
|
|
|
TCP |
5061 · SIP TLS
|
sip-tls
|
Sonde SIP/VoIP
sip voip probe · via SIP TLS:5061 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP-TLS
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_tls_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5061
Chemin / cible
—
Service
SIP TLS
Payload
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
75%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0578
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
�}Т��Dl�Ѣ�p���1��;(ڏ�c��t�O{} ,���X̛O�C� ʆ�T(��m<���� $�,�0�+�/̨̩�$�(�#�' � � k g � � # * ( + - 3 & $ �+ݚ�e���G�,c8J�%%
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 517,
"payload_entropy": 3.697171475486419,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip-tls",
"app_proto": "sip-tls",
"asn": 23470,
"country": "HK",
"dst_port": 5061,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "554e11b9302bdfcd540c45a1cf923952ca5dba5a",
"event_fingerprint": "023bc9d1c35abdce99228ec210a0d9707a172294",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.75,
"classification_confidence": 0.75,
"precision_score": 75,
"precision_signals": [
"pat-0578",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0578",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "sip-tls",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e76cb27c705ce4f9df7639b4d6a46451",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5061,
"service": "sip-tls",
"service_name": "sip-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd+\u075a\ufffde\ufffd\ufffd\u0015\ufffdG\ufffd,c8J\ufffd%\u000f%",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31ca858793458d964637e4f4470088af51e210b8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"evidence_snippet": "\ufffd}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} ,\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\u0286\ufffdT(\ufffd\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 75,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip-tls",
"service_label_fr": "SIP TLS",
"dst_port": 5061,
"protocol_emulated": true,
"tags_summary": [
"pat-0578",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0578",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} \u0004,\u0018\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\f\u0286\u001b\ufffdT(\ufffd\u0013\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
"port": 5061,
"service": "sip-tls",
"service_label_fr": "SIP TLS"
},
"attack_vector": "sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd}\u0422\ufffd\ufffdDl\ufffd\u0462\ufffdp\ufffd\ufffd\ufffd1\ufffd\ufffd;(\u068f\ufffdc\ufffd\ufffdt\ufffdO{} ,\ufffd\ufffd\ufffdX\u031bO\ufffdC\ufffd\u0286\ufffdT(\ufffd\ufffdm<\ufffd\ufffd\ufffd\ufffd\u0382$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
"target_port_label": "5061 \u00b7 SIP TLS",
"emulator_service": "sip-tls",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 75 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip_tls",
"service_banner": "honeypot-sip-tls",
"service_os": "linux",
"dst_port": "5061"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip",
"sip-tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_tls_emulated",
"tls_clienthello"
]
}
|
|
|
TCP |
5060 · SIP
|
sip
|
Sonde SIP/VoIP
sip voip probe · via SIP:5060 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SIP
WAF
—
Recommandation
Surveiller
Tags
net_sip_voip_probe
sip_emulated
sip_payload
sip_voip_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5060
Chemin / cible
—
Service
SIP
Payload
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e To: <sip:62.3.50.33> From: <sip:scanner
Pourquoi cette classification : Type « sip_voip_probe » (signaux protocolaires) · confiance 67%
Confiance classification
67%
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0535
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Localhost SSRF
SIP protocol
HTTP OPTIONS method
SIP OPTIONS
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e
To: <sip:62.3.50.33>
From: <sip:scanner
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e To: <sip:62.3.50.33> From: <sip:scanner@sip.com>;tag=6705f Call-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8 CSeq: 1 OPTIONS User-Agent: Asterisk PBX 18.2.0 Accept: applic
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5349502f322e3020323030204f4b0d0a5669613a205349502f322e302f55445020686f6e6579706f740d0a46726f6d3a203c7369703a686f6e6579706f74406c6f63616c3e3b7461673d6870310d0a546f3a203c7369703a70726f6265406c6f63616c3e3b7461673d6870320d0a43616c6c2d49443a20686f6e6579706f742d",
"emulator_response_len": 215,
"bytes_in": 288,
"payload_entropy": 5.4817517324103715,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "sip",
"app_proto": "sip",
"asn": 23470,
"country": "HK",
"dst_port": 5060,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9d47a028d45c994ea562e4af4fb360bfaa9c2d49",
"event_fingerprint": "3fcb8baeea4f587fed31373e40a068a2b2c72324",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 75,
"precision_signals": [
"pat-0535",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0535",
"INT-upstream"
],
"matched_patterns": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"SIP protocol",
"HTTP OPTIONS method",
"SIP OPTIONS"
],
"pattern_ids": [
"pat-0340",
"pat-0384",
"pat-0420",
"pat-0535"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "sip",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5d1a54ced56024cae6ffa753faeb5b17",
"path_pattern_hash": "12e58fcb9ae07c2755694e8888ea070c"
},
"target_context": {
"dst_port": 5060,
"service": "sip",
"service_name": "sip",
"risk_score": 45
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6705f\r\nCall-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"evidence": {
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner@sip.com>;tag=6705f\r\nCall-ID: 0f0d7bdb0a29487fb66372a3f6d2b5d8\r\nCSeq: 1 OPTIONS\r\nUser-Agent: Asterisk PBX 18.2.0\r\nAccept: applic",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6625cb372fad33906e5c6f14860a79f4ced44e39",
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sip",
"service_label_fr": "SIP",
"dst_port": 5060,
"protocol_emulated": true,
"tags_summary": [
"pat-0535",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0535",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sip",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"port": 5060,
"service": "sip",
"service_label_fr": "SIP"
},
"attack_vector": "sip voip probe \u00b7 via SIP:5060 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 127.0.0.1:5060;branch=z9hG4bKa8c0086e\r\nTo: <sip:62.3.50.33>\r\nFrom: <sip:scanner",
"target_port_label": "5060 \u00b7 SIP",
"emulator_service": "sip",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sip",
"service_banner": "honeypot-sip",
"service_os": "linux",
"dst_port": "5060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sip_voip_probe",
"sip_emulated",
"sip_payload",
"sip_voip_probe"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��@��8�hN"tΊ�6��qR8���U���Q?um� .��A�����N O��� 8x��=fx�i ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.052177340805246,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2e886b117aa3c712c81c8e9777ac06bd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7f921afb5ee93d75d88fb71ecc92e34644fc5de",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdNO\ufffd\ufffd\ufffd8x\u05fd\ufffd\ufffd=fx\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\u001b\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdN\u0001\u001eO\ufffd\ufffd\ufffd\u00008x\u05fd\ufffd\ufffd=fx\ufffd\u0011i\u000b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd@\ufffd\ufffd8\ufffdhN\"t\u038a\ufffd6\ufffd\ufffdqR8\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdQ?um\ufffd .\ufffd\ufffdA\ufffd\u05f7\ufffd\ufffd\ufffd\ufffdNO\ufffd\ufffd\ufffd8x\u05fd\ufffd\ufffd=fx\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.35,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�[e�c!��v��ƛ���-C�6��Rm�T_��T� N\�ӹ��Gk�/�s�����۲��� �r� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.088229971319601,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "f6661a26d432a76d3ee381382fa06dba",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6d818ce9562065288167f00e54a27f815c2f248",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffdRm\ufffdT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffd\u0010Rm\ufffd\u000eT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\u000b\ufffd\u0004r\ufffd\u0003\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd[e\ufffdc!\ufffd\ufffdv\ufffd\ufffd\u019b\ufffd\ufffd\ufffd-C\ufffd6\ufffd\ufffdRm\ufffdT_\ufffd\ufffdT\ufffd N\\\ufffd\u04f9\ufffd\ufffdGk\ufffd\/\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u06f2\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.33,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���b��3̈�h����t�~i��/�l�Ti���� X|$���K�(��H����K� ���%`��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.06558700256614,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "322444b42c185e2e6372da7b1d17e033",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16b68a4f60b6d99eb12f842f93a72585f134f45c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdb\ufffd\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdK\ufffd\t\ufffd\ufffd\ufffd%`\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdb\ufffd\u0010\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\u0011\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\u0017\ufffd\ufffdH\ufffd\ufffd\ufffd\u0004\ufffdK\ufffd\t\u0002\ufffd\ufffd\u0012\ufffd%`\ufffd\u0005\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdb\ufffd\ufffd3\u0308\ufffdh\ufffd\ufffd\ufffd\ufffdt\ufffd~i\ufffd\ufffd\/\ufffdl\ufffdTi\ufffd\ufffd\ufffd\ufffd X|$\ufffd\ufffd\ufffdK\ufffd(\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdK\ufffd\t\ufffd\ufffd\ufffd%`\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�E+���\�ؠ�V�C/�* �%r�U R�� -0���V8�B�c�mC����h� ���#�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.031408601454584,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "eea3fd4d8980d8a43b38ba13c760f4ab",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efdcbd878e898ed9bac1364a6386caedd5fa849c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdE+\ufffd\ufffd\ufffd\\\ufffd\u0620\ufffdV\ufffdC\/\ufffd*\ufffd%r\ufffdUR\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0007E+\ufffd\u0006\ufffd\ufffd\u0002\\\ufffd\u0620\ufffdV\u001b\ufffdC\/\ufffd*\u001d\ufffd%r\ufffdU\u0012\u001d\u0006R\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\u0000\ufffd\ufffd\u0015\ufffd\u0018\u0005#\u0012\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdE+\ufffd\ufffd\ufffd\\\ufffd\u0620\ufffdV\ufffdC\/\ufffd*\ufffd%r\ufffdUR\ufffd\ufffd -0\ufffd\ufffd\ufffdV8\ufffdB\ufffdc\ufffdmC\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.28,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�֯�uƒ��&]w�Ç/5� v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�֯�uƒ��&]w�Ç/5�
v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�֯�uƒ��&]w�Ç/5� v��^���K�%)k ���<ϗ-Y:��}n}X�\��̀Iҝ�B�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.098377657519625,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "99b05dbbc29f0ed8ed39ba17575b30f8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de2c62436a162701c2f0b2cbad1bd308b4cd0f11",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\u05af\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u05af\u000f\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\u000f\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\b\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\u0019\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\u05af\ufffdu\u0192\ufffd\ufffd&]w\ufffd\u00c7\/5\ufffd\rv\ufffd\ufffd^\ufffd\ufffd\ufffdK\ufffd%)k \ufffd\ufffd\ufffd<\u03d7-Y:\ufffd\ufffd}n}X\ufffd\\\ufffd\ufffd\u0340I\u049d\ufffdB\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.26,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�۩�� �wx#!���U��?R�``� ���vp ��OWkA�Sm�� ��F��(��ΐ�S I��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.076484091046866,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "9d282c9dd44fac94a14adb7d03248ff0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ef0714447c9981df585c82800de731c6ba59ad6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\u06e9\ufffd\ufffd\ufffdwx#!\ufffd\ufffd\ufffdU\ufffd\ufffd?R\ufffd``\ufffd\ufffd\ufffd\ufffdvp \ufffd\ufffdOWkA\ufffdSm\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdSI\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\u06e9\ufffd\ufffd\f\ufffdwx#!\ufffd\ufffd\ufffdU\u0011\ufffd\ufffd?R\ufffd\u001a``\ufffd\f\ufffd\ufffd\ufffdvp\u0010 \ufffd\ufffd\u000fOWkA\ufffdSm\ufffd\ufffd\u0000\ufffd\ufffdF\b\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdS\u001eI\u001b\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\u06e9\ufffd\ufffd\ufffdwx#!\ufffd\ufffd\ufffdU\ufffd\ufffd?R\ufffd``\ufffd\ufffd\ufffd\ufffdvp \ufffd\ufffdOWkA\ufffdSm\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd(\ufffd\ufffd\u0390\ufffdSI\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5064 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5064 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Service
TLS
Payload
��(���h��dބ�gęY��e< �� (���V Q8 ���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��(���h��dބ�gęY��e<
�� (���V Q8
���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��(���h��dބ�gęY��e< �� (���V Q8 ���m �M�e���Z�F�vj ��}� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.028315333353045,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
"event_fingerprint": "eeab959430ed37fa7c795b56e80e1edd6840a0c3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c64814589d87c8ff304097ba928c12a0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5064,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96ad96b798c56d32a5511123b2caa7ec7d75c669",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd(\ufffd\ufffd\ufffdV Q8\n\ufffd\ufffd\ufffdm\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffdvj\u05eb\ufffd\ufffd}\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd\u0000(\ufffd\ufffd\ufffdV \u0016Q8\n\ufffd\u0002\ufffd\ufffdm\u0000\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffd\u0015vj\u05eb\u001c\u0011\ufffd\ufffd}\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5064,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5064 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffdh\ufffd\ufffdd\u0784\ufffdg\u0119Y\ufffd\ufffde<\r\ufffd\ufffd(\ufffd\ufffd\ufffdV Q8\n\ufffd\ufffd\ufffdm\ufffdM\ufffde\ufffd\ufffd\ufffdZ\ufffdF\ufffdvj\u05eb\ufffd\ufffd}\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5064 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w� ����;�B�^ ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w�
����;�B�^
��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�y'����j X@�ķ��<��������#��0I{ �Y+����������;r;w� ����;�B�^ ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.05871340528831,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "dc62925bf7a6d7527f0009a1bb52ae33",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191666c7cd7cce75d2f1ef59ad17dbc4ff766467",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdy'\ufffd\ufffd\ufffd\ufffdjX@\ufffd\u0137\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y'\ufffd\ufffd\ufffd\ufffdj\fX@\ufffd\u0137\ufffd\ufffd<\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY\u0013+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\u0011\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdy'\ufffd\ufffd\ufffd\ufffdjX@\ufffd\u0137\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd0I{ \ufffdY+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;r;w\ufffd\r\ufffd\ufffd\ufffd\ufffd;\ufffdB\ufffd^\n\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.19,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�W�����T��e�\c��T���w��pΛ�m� h4c��|���b������$W_��F\��W�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 4.995980348816743,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2bd229b2a009de6d0e816d70c9cf4660",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62bb8bcab2d711767239471246f8cf8d6a4af4f0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffdm\ufffd h4c\ufffd\ufffd|\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\u000e\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\u0001\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffd\u0014m\ufffd\u001e h4c\ufffd\ufffd|\u0001\ufffd\ufffd\ufffdb\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\u0002\ufffd\ufffdW\ufffd\u0013\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffde\ufffd\\c\ufffd\ufffdT\ufffd\ufffd\ufffdw\ufffd\ufffdp\u039b\ufffdm\ufffd h4c\ufffd\ufffd|\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$W_\ufffd\ufffdF\\\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 5.09,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��̙��Lꭄ�\�8y��g������F��N���Z �|�5�%��k��qj,>�Q# ���-�|� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.066833067386438,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "dd49e85da3aa639a4972f778eb1c4545",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "409badc242a265c1e196d2786bea146ffb2da24e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffdZ \ufffd|\ufffd5\ufffd%\ufffd\ufffdk\ufffd\ufffdqj,>\ufffdQ#\ufffd\ufffd\ufffd-\ufffd|\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffd\u0007Z \ufffd\u001b\u0004|\ufffd5\ufffd%\u0007\ufffd\u0019\ufffdk\ufffd\ufffdqj,>\ufffdQ#\u001d\u001e\ufffd\ufffd\ufffd-\u0005\ufffd|\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u0319\ufffd\ufffdL\uab44\ufffd\\\ufffd8y\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdN\ufffd\ufffd\ufffdZ \ufffd|\ufffd5\ufffd%\ufffd\ufffdk\ufffd\ufffdqj,>\ufffdQ#\ufffd\ufffd\ufffd-\ufffd|\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.97,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
� 3�\Y�3[`� ��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� 3�\Y�3[`�
��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
� 3�\Y�3[`� ��(G����1�����40O�� ^��F�f�.5pAT������N �\���q�g��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.064241162472857,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "2c890461330c8c6b0ad05ffefcfd865e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8f3b641cd01fda68cef307efb6fae51910ed2a3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\ufffd(G\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001c3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\u0006\ufffd(G\ufffd\ufffd\ufffd\ufffd1\u0019\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\ufffdN\u0000\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd3\ufffd\\Y\ufffd3[`\ufffd\r\ufffd\ufffd(G\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd40O\ufffd\ufffd ^\ufffd\ufffdF\ufffdf\ufffd.5pAT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd\\\ufffd\ufffd\ufffdq\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.92,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���� {yN֝��-�cT�L�z$rh����> �� ��3���I��$�2��s��0�s5/^]�`R�`� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.034355542016214,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "76738e86b9b819f914a184ae5ae8f267",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5421579c290892665b944c0d9b6a2889d7e4b630",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{yN\u059d\ufffd\ufffd-\ufffdcT\ufffdL\ufffdz$rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001c{yN\u059d\ufffd\ufffd-\u000e\ufffdcT\ufffdL\ufffdz$\u0019rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\u0002\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd{yN\u059d\ufffd\ufffd-\ufffdcT\ufffdL\ufffdz$rh\ufffd\ufffd\ufffd\ufffd> \ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffdI\ufffd\ufffd$\ufffd2\ufffd\ufffds\ufffd\ufffd0\ufffds5\/^]\ufffd`R\ufffd`\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.89,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��I�< 6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I ��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��I�<
6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I
��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��I�< 6��n-�d�|�܅j�sdf� i�,�X !� k�]Fba>x�A�=�I ��p�Α\<UG� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.069243637945447,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "6b2342ccef28f11dddfc7b3df98b29e6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f1f0ea095b736a46a725084d98e2c14ba3b55e0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdI\ufffd<\r6\ufffd\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd,\ufffdX !\ufffdk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\ufffd\ufffdp\ufffd\u0391\\<UG\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffd<\r6\ufffd\u0002\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd\u0014,\ufffdX !\ufffd\u001dk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\f\ufffd\ufffd\u0001p\ufffd\u0391\\\u0018<UG\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdI\ufffd<\r6\ufffd\ufffdn-\ufffdd\ufffd|\ufffd\u0705j\ufffdsdf\ufffd\ti\ufffd,\ufffdX !\ufffdk\ufffd]Fba>x\ufffdA\ufffd=\ufffdI\r\ufffd\ufffdp\ufffd\u0391\\<UG\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.87,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N� Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N�
Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
����a|:$�U~ Z��ZJ{78�I����X!�.�� �}"q3 B�oA�+��i�r�V4�N� Xb��&� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.072163227632063,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c83e851d502f21fe3019b955219fb3c2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36064ebbfdab87346f04437496968c547479ab86",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{78\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"q3\tB\ufffdoA\ufffd+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{7\u001a8\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"\u0007q3\tB\ufffdoA\ufffd\u0005+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda|:$\ufffdU~ Z\ufffd\ufffdZJ{78\ufffdI\ufffd\ufffd\ufffd\ufffdX!\ufffd.\ufffd\ufffd \ufffd}\"q3\tB\ufffdoA\ufffd+\ufffd\ufffdi\ufffdr\ufffdV4\ufffdN\ufffd\rXb\ufffd\ufffd&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��v�+�܀3_�(T�J����r�Yz�m��|t � ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\| ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��v�+�܀3_�(T�J����r�Yz�m��|t
� ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\| ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��v�+�܀3_�(T�J����r�Yz�m��|t � ��h�Q&$2�2�!b�}Xn�ԉ�ٽ�ɓ��\| ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.046014880819623,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "b05e63c3d708396d53d877ddb6a66281",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4dc314072766f626c8a63d92c7847d8ed893349",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdv\ufffd+\ufffd\u07003_\ufffd(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\ufffd+\ufffd\u07003_\ufffd\u0014(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\u0002\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}\u0015Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdv\ufffd+\ufffd\u07003_\ufffd(T\ufffdJ\ufffd\ufffd\ufffd\ufffdr\ufffdYz\ufffdm\ufffd\ufffd|t\n\ufffd \ufffd\ufffdh\ufffdQ&$2\ufffd2\ufffd!b\ufffd}Xn\ufffd\u0509\ufffd\u067d\ufffd\u0253\ufffd\ufffd\\|\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.83,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
� ��m^u:�0�j(�u�G�7�߀BK�( ����h ���Q�3�-N��d�����cԥ� �0���� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��m^u:�0�j(�u�G�7�߀BK�( ����h ���Q�3�-N��d�����cԥ� �0���� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
� ��m^u:�0�j(�u�G�7�߀BK�( ����h ���Q�3�-N��d�����cԥ� �0���� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.064190864404135,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "59bfe51a1d8b166d14e5d18cb9ba19be",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e18784a201beea6bd52d91083fabc91044d2ad97",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdm^u:\ufffd0\ufffdj(\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\ufffdQ\ufffd3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdc\u0525\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e\ufffd\ufffdm^u:\ufffd0\ufffdj(\u0019\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\u000b\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\u000f\ufffdQ\ufffd\u001a3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\u000e\ufffdc\u0525\ufffd\u000b\ufffd0\ufffd\u0016\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdm^u:\ufffd0\ufffdj(\ufffdu\ufffdG\ufffd7\ufffd\u07c0BK\ufffd(\ufffd\ufffd\ufffd\ufffdh \ufffd\ufffd\ufffdQ\ufffd3\ufffd-N\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdc\u0525\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.38,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d� h�sz 3f�z H�e�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d� h�sz
3f�z H�e�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�P�cъq�ݚ�s�+'o52=�n��:��a� �B� �\��uX�d� h�sz 3f�z H�e�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.06178662263089,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "5f568415140aaa8ee6c7f99a14f1a2ec",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd45311bd56270213780255e935a323846c10236",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdP\ufffdc\u044aq\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\ufffd:\ufffd\ufffda\ufffd \ufffdB\ufffd \ufffd\\\ufffd\ufffduX\ufffdd\ufffdh\ufffdsz\r3f\ufffdz H\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003P\ufffdc\u044aq\b\u0005\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\u000e\ufffd\u0017\u0013:\ufffd\ufffda\ufffd \ufffdB\ufffd \u000e\ufffd\\\ufffd\ufffdu\u0007X\ufffdd\ufffd\u001ch\ufffdsz\r3f\ufffdz \u0005H\ufffde\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdP\ufffdc\u044aq\ufffd\u075a\ufffds\ufffd+'o52=\ufffdn\ufffd\ufffd:\ufffd\ufffda\ufffd \ufffdB\ufffd \ufffd\\\ufffd\ufffduX\ufffdd\ufffdh\ufffdsz\r3f\ufffdz H\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.37,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�����² �}ɠ8�� ݦ�{M��,42�3�y р�v�)ғ^��_� HJ=�！�#kH � ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�����² �}ɠ8�� ݦ�{M��,42�3�y р�v�)ғ^��_�
HJ=�！�#kH � ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�����² �}ɠ8�� ݦ�{M��,42�3�y р�v�)ғ^��_� HJ=�！�#kH � ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.075729043608639,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c40f426e10b5f7ae57ddfae82d8ee31a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "043da3b281354fe732ff29a42d1bd4e48996d373",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd}\u02608\ufffd\ufffd\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy \u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0010\ufffd\u00b2\f\ufffd}\b\u02608\ufffd\ufffd\u001d\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy\u0016 \u0017\u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\u0017\u0000\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd}\u02608\ufffd\ufffd\u0766\ufffd{M\ufffd\ufffd,42\ufffd3\ufffdy \u0440\ufffdv\ufffd)\u0493^\ufffd\ufffd_\ufffd\rHJ=\ufffd\uff01\ufffd#kH\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.35,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�H����Yh�p���,���K5�}X� ��-�� g 8�.D�Q���D���ؠlPʢ�5BW�fK ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�H����Yh�p���,���K5�}X� ��-�� g
8�.D�Q���D���ؠlPʢ�5BW�fK ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�H����Yh�p���,���K5�}X� ��-�� g 8�.D�Q���D���ؠlPʢ�5BW�fK ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.010485841734837,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "fc1415f4f6be2c29e1906689e9023cee",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b1f38a7722d009e7eed7d8988c93289b1c99dd2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdH\ufffd\ufffd\ufffd\ufffdYh\ufffdp\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n8\ufffd.D\ufffdQ\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffdfK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003H\ufffd\ufffd\ufffd\u0005\ufffd\u0014Yh\ufffdp\ufffd\u0019\ufffd\ufffd,\ufffd\ufffd\u0002\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n\u0007\u00188\ufffd.D\ufffdQ\ufffd\u0010\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffd\u0010fK\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdH\ufffd\ufffd\ufffd\ufffdYh\ufffdp\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdK5\ufffd}X\ufffd\t\ufffd\ufffd-\ufffd\ufffd g\n8\ufffd.D\ufffdQ\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0620lP\u02a2\ufffd5BW\ufffdfK\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.34,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
���Ie���8��w)���6�L��n5,���� �&�� ���d*��NlR�j�]����j��Nx ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���Ie���8��w)���6�L��n5,���� �&�� ���d*��NlR�j�]����j��Nx ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���Ie���8��w)���6�L��n5,���� �&�� ���d*��NlR�j�]����j��Nx ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.055739571267462,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "85add381dab11faa89c1d5a32ed9edaa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23bbe5eb5f93b39819c0527df1c3751383b717ac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdNx\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5\u0013,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\u0005\ufffd\u000b\ufffd\u0011\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\u001b\ufffd\ufffd\ufffdj\ufffd\ufffdNx\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdIe\ufffd\ufffd\ufffd8\ufffd\ufffdw)\ufffd\ufffd\ufffd6\ufffdL\ufffd\ufffdn5,\ufffd\ufffd\ufffd\ufffd \ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdd*\ufffd\ufffdNlR\ufffdj\ufffd]\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdNx\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.32,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
��)v��y]N�$y#��S �%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��)v��y]N�$y#��S
�%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
��)v��y]N�$y#��S �%�AO"�"GB"� �I�o)�/�#�5$�U;N��t�_�+�\��<'�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.0322680057472535,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "45c46af90271192efacadb0548da1408",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b0c3d3b1ab17e0cc36aa5a4da114329876f1771",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd)v\ufffd\ufffdy]N\ufffd$y#\ufffd\ufffdS\n\ufffd%\ufffdAO\"\ufffd\"GB\"\ufffd \ufffdI\ufffdo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd)v\ufffd\u001b\ufffdy]\u0005N\ufffd$y#\ufffd\ufffdS\n\ufffd%\u0019\ufffdAO\u000f\"\ufffd\"GB\"\ufffd \ufffdI\ufffd\bo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd)v\ufffd\ufffdy]N\ufffd$y#\ufffd\ufffdS\n\ufffd%\ufffdAO\"\ufffd\"GB\"\ufffd \ufffdI\ufffdo)\ufffd\/\ufffd#\ufffd5$\ufffdU;N\ufffd\ufffdt\ufffd_\ufffd+\ufffd\\\ufffd\ufffd<'\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
���4�W�e��;���2��K� ��'� �X v��C�/ޥ0 ���2�ͽx��h�, ��nj:t� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���4�W�e��;���2��K� ��'� �X v��C�/ޥ0
���2�ͽx��h�,
��nj:t� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���4�W�e��;���2��K� ��'� �X v��C�/ޥ0 ���2�ͽx��h�, ��nj:t� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.036717495014359,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "d88eff9ed010e4dc7ad071a2fe9d71d7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e05638c4c45f48cbf34e2c39521edd2ca52c91cc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd4\ufffdW\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\ufffd\ufffdK\ufffd\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a50\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000f\ufffd4\ufffdW\u0014\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\u0006\ufffd\ufffdK\ufffd\u0004\f\u001d\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a5\u00070\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd4\ufffdW\ufffde\ufffd\ufffd;\ufffd\ufffd\ufffd2\ufffd\ufffdK\ufffd\ufffd\ufffd'\ufffd \ufffdX v\ufffd\ufffdC\ufffd\/\u07a50\r\ufffd\ufffd\ufffd2\ufffd\u037dx\ufffd\ufffdh\ufffd,\n\ufffd\ufffdnj:t\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.3,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5067 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5067 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5067
Chemin / cible
—
Service
TLS
Payload
�����m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby $�͗����*�4� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�����m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby $�͗����*�4� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�����m��uS�(Ẃ3��\%F �hg�_� �s�k(t]�+ �V��Wby $�͗����*�4� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 4.977687014859778,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5067,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf544fa11dc2798a0e184cc7c5eb731532dfad11",
"event_fingerprint": "29458c9c7a009d453cd8dd8f24a132851f3a0a15",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "94de5ae1e6941ae40d3fca11dfba44a4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5067,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2e99e130cf8afecaf9099917594c3bf94c15215",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\%F \ufffdhg\ufffd_\ufffd \ufffds\ufffdk(t]\ufffd+\t\ufffdV\ufffd\ufffdWby$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5067,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\\b%\u0012F\u0000 \u0005\ufffdhg\ufffd_\ufffd \ufffds\ufffd\u0015k(t]\ufffd+\t\ufffdV\ufffd\ufffdWby\u000b$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\u001b\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5067,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5067 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffduS\ufffd(W\u03013\ufffd\ufffd\\%F \ufffdhg\ufffd_\ufffd \ufffds\ufffdk(t]\ufffd+\t\ufffdV\ufffd\ufffdWby$\ufffd\u0357\ufffd\ufffd\ufffd\ufffd*\ufffd4\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5067 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5067"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
5061,
5062,
5063,
5064,
5065,
5066,
5067,
5068,
5069
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 4.29,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�u�����by����+��t� :s��p��4D� ����8�ع4�����J��CMeY��2� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�u�����by����+��t� :s��p��4D� ����8�ع4�����J��CMeY��2� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�u�����by����+��t� :s��p��4D� ����8�ع4�����J��CMeY��2� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.090200783201618,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "4830da7eb6159505af668b4fea15dd3e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47e3c3fe1e06aef9a9d38177f57704e0af07f5a5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdby\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd:s\ufffd\ufffdp\ufffd\ufffd4D\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003u\ufffd\ufffd\ufffd\ufffd\ufffdb\u0013y\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd\f:s\ufffd\ufffdp\ufffd\ufffd4\u000fD\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\u0014\ufffd\ufffd\ufffd\u0001\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\u0010\ufffd2\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdby\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffdt\ufffd:s\ufffd\ufffdp\ufffd\ufffd4D\ufffd \ufffd\ufffd\ufffd\u07fc\ufffd8\ufffd\u06394\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdCMeY\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.98,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�PA뗠���} �M(J�~CD�i {F��r� x�-퍷D�X��� ^1� u ��� \��뼷� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�PA뗠���}
�M(J�~CD�i {F��r� x�-퍷D�X��� ^1� u ��� \��뼷� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�PA뗠���} �M(J�~CD�i {F��r� x�-퍷D�X��� ^1� u ��� \��뼷� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.024386147760822,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "8611f9de11896f9bf37686fe91c340cc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07ab697c9763da86d37975d77ca1d89b8e07db5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdPA\ub5e0\ufffd\ufffd\ufffd}\n\ufffdM(J\ufffd~CD\ufffdi{F\ufffd\ufffdr\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd^1\ufffdu\ufffd\ufffd\ufffd \\\ufffd\ufffd\ubf37\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003PA\ub5e0\ufffd\u001b\ufffd\ufffd\u0013}\n\ufffdM(J\ufffd~CD\ufffdi\f{\u0005F\ufffd\ufffd\u0019r\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd\u001d^\u00021\ufffd\u0000u\u001f\ufffd\ufffd\u0005\ufffd \\\ufffd\ufffd\ubf37\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdPA\ub5e0\ufffd\ufffd\ufffd}\n\ufffdM(J\ufffd~CD\ufffdi{F\ufffd\ufffdr\ufffd x\ufffd-\ud377D\ufffdX\ufffd\ufffd\ufffd^1\ufffdu\ufffd\ufffd\ufffd \\\ufffd\ufffd\ubf37\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.93,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
���B��z���l�H��.�F4�z� \�� h!�/s�G� ����t�� X ����V�n? ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���B��z���l�H��.�F4�z� \�� h!�/s�G�
����t�� X
����V�n? ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
���B��z���l�H��.�F4�z� \�� h!�/s�G� ����t�� X ����V�n? ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.017046845489416,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c1ff3cd7921e10a559ec668b8e6bc430",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be6060a137a298de7fdef6837eb5d62e28a5d5d6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffd\ufffdl\ufffdH\ufffd\ufffd.\ufffdF4\ufffdz\ufffd\\\ufffd\ufffd h!\ufffd\/s\ufffdG\ufffd\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdX\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0007B\ufffd\u0018\ufffdz\ufffd\ufffd\u0005\ufffdl\ufffdH\ufffd\ufffd.\u0013\ufffdF4\ufffdz\ufffd\u001e\u0017\u0017\\\ufffd\ufffd \u0012h!\ufffd\/s\ufffdG\ufffd\u0005\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000X\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffd\ufffdl\ufffdH\ufffd\ufffd.\ufffdF4\ufffdz\ufffd\\\ufffd\ufffd h!\ufffd\/s\ufffdG\ufffd\r\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffdX\r\ufffd\ufffd\ufffd\ufffdV\ufffdn?\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�a 7����Ǹ����d.���k�fr�����9�� �ͅ�.��>U��@�/;\݅����&�\����� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�a 7����Ǹ����d.���k�fr�����9�� �ͅ�.��>U��@�/;\݅����&�\����� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�a 7����Ǹ����d.���k�fr�����9�� �ͅ�.��>U��@�/;\݅����&�\����� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.052186075357377,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "7530e474e47c757c20198d72e4478697",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b25fdd1775fc02b2bc695f3618b4bf0cb18072b6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffda7\ufffd\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\/;\\\u0745\ufffd\ufffd\ufffd\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\u001c7\ufffd\u0005\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\u0001\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\u001a\/;\\\u0745\ufffd\ufffd\ufffd\u0014\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffda7\ufffd\ufffd\ufffd\ufffd\u01f8\ufffd\ufffd\ufffd\ufffdd.\ufffd\ufffd\ufffdk\ufffdfr\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd \ufffd\u0345\ufffd.\ufffd\ufffd>U\ufffd\ufffd@\ufffd\/;\\\u0745\ufffd\ufffd\ufffd\ufffd&\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.79,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
� �c +�6`��m:� �x� ���fk�!�c� �w�=�*�Z�G��%��&� #�>+Ɓ��m ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �c +�6`��m:� �x� ���fk�!�c� �w�=�*�Z�G��%��&� #�>+Ɓ��m ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
� �c +�6`��m:� �x� ���fk�!�c� �w�=�*�Z�G��%��&� #�>+Ɓ��m ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.064124892089081,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "5a0c29799e4789515e4417270d811103",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd*\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd*\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd*\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1aa340c004ea71d70c7d07f372345af20e9d57ec",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd*\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdc+\ufffd6`\ufffd\ufffdm:\ufffd\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd \ufffdw\ufffd=\ufffd*\ufffdZ\ufffdG\ufffd\ufffd%\ufffd\ufffd&\ufffd#\ufffd>+\u0181\ufffd\ufffdm\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001f\ufffdc\u0018\u001f\u0011+\ufffd6`\ufffd\ufffdm:\ufffd\u0000\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd\u000b\u0016 \ufffdw\ufffd=\ufffd*\u001a\ufffdZ\ufffdG\u001b\ufffd\ufffd%\ufffd\ufffd\u0014&\ufffd\u001c#\u0012\ufffd>+\u0181\ufffd\u0011\ufffdm\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdc+\ufffd6`\ufffd\ufffdm:\ufffd\ufffdx\ufffd\t\ufffd\ufffd\ufffdfk\ufffd!\ufffdc\ufffd \ufffdw\ufffd=\ufffd*\ufffdZ\ufffdG\ufffd\ufffd%\ufffd\ufffd&\ufffd#\ufffd>+\u0181\ufffd\ufffdm\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.67,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�����[���!̴����hH�]M^O������^ �@D�%S�����V <�]\c�C��`(�.� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�����[���!̴����hH�]M^O������^ �@D�%S�����V <�]\c�C��`(�.� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�����[���!̴����hH�]M^O������^ �@D�%S�����V <�]\c�C��`(�.� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.047071948955126,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "522f1c43f28a7920d3c3b1a3e092233e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa813050c76af0ec5db7647b14bc10b8add99f2f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^ \ufffd@D\ufffd%S\ufffd\ufffd\ufffd\ufffd\ufffdV<\ufffd]\\c\ufffdC\ufffd\ufffd`(\ufffd.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\b\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\u000f\u0012 \ufffd@D\ufffd%\u0005S\ufffd\ufffd\ufffd\ufffd\u0016\ufffdV\u001c<\u0004\b\ufffd]\\c\ufffd\u001bC\ufffd\ufffd`(\ufffd.\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd!\u0334\ufffd\ufffd\ufffd\ufffdhH\ufffd]M^O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^ \ufffd@D\ufffd%S\ufffd\ufffd\ufffd\ufffd\ufffdV<\ufffd]\\c\ufffdC\ufffd\ufffd`(\ufffd.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
������ g4;5joR�;���Η���T�D� ��t��p$P PL�����c���KoJ��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
������
g4;5joR�;������T�D� ��t��p$P
PL�����c���KoJ��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
������ g4;5joR�;���Η���T�D� ��t��p$P PL�����c���KoJ��� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.050463162230656,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "c9fccc20a5eca0f03cb28d9f81d69cfd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54ba21456bbd55b0c57fcf36cb5ab54244ee7cea",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rg4;5joR\ufffd;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\ufffdp$P\nPL\ufffd\ufffd\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\r\u0006g4;5\u0002j\u0001oR\ufffd\u0019;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\u0011\ufffd\u0013p$P\nP\u000fL\ufffd\ufffd\u0018\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rg4;5joR\ufffd;\ufffd\ufffd\ufffd\u0397\ufffd\ufffd\ufffdT\ufffdD\ufffd \ufffd\ufffdt\ufffd\ufffdp$P\nPL\ufffd\ufffd\ufffd\ufffd\ufffdc\u058b\ufffd\ufffd\ufffdKoJ\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.56,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�ᐻ�ˬ���Bha���I�R��o�u�L��`$� �q� �� j��\5T��Uz��g_(�9gbO�%B ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�ᐻ�ˬ���Bha���I�R��o�u�L��`$� �q� �� j��\5T��Uz��g_(�9gbO�%B ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�ᐻ�ˬ���Bha���I�R��o�u�L��`$� �q� �� j��\5T��Uz��g_(�9gbO�%B ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.060019371966197,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "855e77a297e47ca20d8026a770114278",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53848fd75d9d4f4ad5db3b05c60b86d9fea3d410",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\u143b\ufffd\u02ec\ufffd\ufffd\ufffdBha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\ufffd\ufffdj\ufffd\ufffd\\5T\ufffd\ufffdUz\ufffd\ufffdg_(\ufffd9gbO\ufffd%B\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u143b\ufffd\u02ec\ufffd\u0019\ufffd\ufffdB\u0005ha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\u001c\ufffd\ufffd\fj\ufffd\ufffd\\5T\u0012\ufffd\ufffdUz\ufffd\ufffdg_\u0018(\ufffd9gbO\ufffd%B\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\u143b\ufffd\u02ec\ufffd\ufffd\ufffdBha\ufffd\ufffd\ufffdI\ufffdR\ufffd\ufffdo\ufffdu\ufffdL\ufffd\ufffd`$\ufffd \ufffdq\ufffd\ufffd\ufffdj\ufffd\ufffd\\5T\ufffd\ufffdUz\ufffd\ufffdg_(\ufffd9gbO\ufffd%B\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.51,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5066 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:5066 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
JA3 cc61f04eb7a2e049
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5066
Chemin / cible
—
Service
TLS
Payload
�Rmw� ���8��U�]��C )s�g1hA�� ��U$J$F�ǚ ���O��y���F�}�bN�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�Rmw� ���8��U�]��C )s�g1hA�� ��U$J$F�ǚ ���O��y���F�}�bN�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � �����
Requête brute (extrait)
�Rmw� ���8��U�]��C )s�g1hA�� ��U$J$F�ǚ ���O��y���F�}�bN�� ��,�0 � �̨̩̪���������]�a�W�S ��+�/ � ����������\�`�V�R ��$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ������Q ������P = � < � 5 � / A �
Meta JSON brut
{
"tls_ja3_hash": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 24,
"bytes_in": 517,
"payload_entropy": 5.0396483427002154,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5066,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d3174bb3ca9bb638f8de00faf854c8540efc70d",
"event_fingerprint": "493d81505458f233e751671ae272edd15ecfb679",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"payload_hash": "4b3f5f1d0b95079f80ce8aada91a58ad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5066,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2248ef5adddb0a0dec8af90b7f69009505ce1e7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffdRmw\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffdg1hA\ufffd\ufffd \ufffd\ufffdU$J$F\ufffd\u01da\ufffd\ufffd\ufffdO\ufffd\ufffdy\ufffd\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5066,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Rmw\ufffd\u001a\f\ufffd\ufffd\ufffd8\ufffd\u000e\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffd\u0011g1h\u0006A\ufffd\ufffd\u000e \ufffd\ufffdU$J$F\ufffd\u01da\u001c\ufffd\ufffd\ufffdO\ufffd\u0001\ufffdy\ufffd\u0001\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"tls_ja3": "cc61f04eb7a2e049ef5095a5eb5a4ae0",
"port": 5066,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:5066 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffdRmw\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffdU\ufffd]\ufffd\ufffdC\t)s\ufffdg1hA\ufffd\ufffd \ufffd\ufffdU$J$F\ufffd\u01da\ufffd\ufffd\ufffdO\ufffd\ufffdy\ufffd\ufffd\ufffdF\ufffd}\ufffdbN\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "5066 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5066"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5061,
5063,
5065,
5066
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 5.46,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sip-tls",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|