|
|
TCP |
7001 · WEBLOGIC
|
weblogic
|
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
GIOP
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 5,
"payload_entropy": 2.321928094887362,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "87e8503fc1fa9337182ff6baaa9ea402",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "GIOP\n",
"request_sample": "GIOP\n",
"payload_snippet": "GIOP",
"evidence": {
"request_sample": "GIOP\n",
"payload_snippet": "GIOP",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b3f1bdb0cccc6fa76ea5e02ad8f08d1f24affb8",
"protocol_details": {
"payload_preview": "GIOP",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "GIOP",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GIOP",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GIOP",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 24,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
|
|
|
TCP |
7001 · WEBLOGIC
|
weblogic
|
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://localhost:7001\nLP:DOMAIN\n\n
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://localhost:7001\nLP:DOMAIN\n\n
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 76,
"payload_entropy": 4.529464436404715,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6c24de847ea2758b7ab499e13cb3f9b3",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"request_sample": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"payload_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"evidence": {
"request_sample": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"payload_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f00ce6c0f65493bdb6e2540939c03fa7389037cf",
"protocol_details": {
"payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 24,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde port 7001/TCP
port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /index.html
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /index.html UA curl/8.18.0
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/index.html
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/index.html
Preuve honeypot — Sonde port 7001/TCP
Connexion détectée sur le port 7001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /index.html HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
scanner-ua
Payload (extrait)
GET /index.html HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "html",
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 89,
"payload_entropy": 4.984215808671972,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "14268ee52afd0b5291bd0e48cbec364c9992b576",
"event_fingerprint": "cac7c15593907d2143f9e6831fc7b561af7347ca",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "a2c56fd294d0d8d91e9756fda0c81cfb",
"path_pattern_hash": "213456c5dc963e03ec1f27600c46c954"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/index.html",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/index.html HTTP\/1.1",
"request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/index.html",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/index.html HTTP\/1.1",
"request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f24a8f9ed277e2e9a5da51df326391ce5962cdd3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/index.html",
"request_line": "GET \/index.html HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/index.html",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/index.html",
"request_line": "GET \/index.html HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/index.html",
"evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /etc/passwd
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA curl/8.18.0
Émulateur
HTTP
WAF
17
Recommandation
Investiguer
Tags
950264:lfi-1
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
lfi-1
nosqli-3
scanner-ua
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 89,
"payload_entropy": 4.908788353366387,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 76,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 76,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 57,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "dc7e570db9c010dc90574d9011569e5ce6612cae",
"event_fingerprint": "f344e6b627c949331b45f4c0866a55a5d25daa72",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0137"
],
"confidence_breakdown": {
"waf": 76,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "b10ad0dcd870e572c798ddf16134b675",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950264:lfi-1",
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"lfi-1",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950264:lfi-1",
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"lfi-1",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32e3bf429b6bb85dce13ab1b390e8501831b088f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 76,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 76 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde port 7001/TCP
port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /xyzzy123nonexistent
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /xyzzy123nonexistent UA curl/8.18.0
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/xyzzy123nonexistent
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/xyzzy123nonexistent
Preuve honeypot — Sonde port 7001/TCP
Connexion détectée sur le port 7001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /xyzzy123nonexistent HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
scanner-ua
Payload (extrait)
GET /xyzzy123nonexistent HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "8806a414d8e20a12dd95049c6e3e79c9ccea0894",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.987849840467882,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "14268ee52afd0b5291bd0e48cbec364c9992b576",
"event_fingerprint": "51441ea8a70fcd266b252ce238850ce0abeda9fa",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "be5405461ffcb810f2e4f29fc7b10c23",
"path_pattern_hash": "9065f39222d0eef25e94df9a5410440f"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/xyzzy123nonexistent",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/xyzzy123nonexistent HTTP\/1.1",
"request_sample": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/xyzzy123nonexistent",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/xyzzy123nonexistent HTTP\/1.1",
"request_sample": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f48bad24e156d0fccab1107cd0778daccd0d9e7b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/xyzzy123nonexistent",
"request_line": "GET \/xyzzy123nonexistent HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/xyzzy123nonexistent",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/xyzzy123nonexistent",
"request_line": "GET \/xyzzy123nonexistent HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/xyzzy123nonexistent",
"evidence_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde port 7001/TCP
port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /ws_utc/begin.do
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /ws_utc/begin.do UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/ws_utc/begin.do
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/ws_utc/begin.do
Preuve honeypot — Sonde port 7001/TCP
Connexion détectée sur le port 7001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /ws_utc/begin.do HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /ws_utc/begin.do HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "do",
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "7ed3cdd8446f34870607542f360362a65fec7572",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 94,
"payload_entropy": 4.997623863819755,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f",
"event_fingerprint": "b8aba1e86d022a3610704402f922686cdd3b018f",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 40,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "7c3b4e862759d44b3d152bc6199bf2b5",
"path_pattern_hash": "379831a3339bbfacffb13ab7c9588e0d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/ws_utc\/begin.do",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/ws_utc\/begin.do HTTP\/1.1",
"request_sample": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/ws_utc\/begin.do",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/ws_utc\/begin.do HTTP\/1.1",
"request_sample": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c593c255f5660b3a6ef9ccaea83f2664550a73e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/ws_utc\/begin.do",
"request_line": "GET \/ws_utc\/begin.do HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ws_utc\/begin.do",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/ws_utc\/begin.do",
"request_line": "GET \/ws_utc\/begin.do HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ws_utc\/begin.do",
"evidence_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
],
"behavior_alert_count": 2,
"behavior_priority": 72
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /bea_wls_internal/
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /bea_wls_internal/ UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/bea_wls_internal/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/bea_wls_internal/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET /bea_wls_internal/ HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /bea_wls_internal/ HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "6d299ba7710f14e2f9805c600e6fa48f4e3660e8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 96,
"payload_entropy": 5.013689689349748,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f",
"event_fingerprint": "aa30c89c7f87ba0daaa0b64c4c55c6fd479d3285",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "b841073e3c3caa12ed3e56a1bf39cb8b",
"path_pattern_hash": "717f23bb07baf9c07a18b2acf638d391"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/bea_wls_internal\/",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/bea_wls_internal\/ HTTP\/1.1",
"request_sample": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/bea_wls_internal\/",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/bea_wls_internal\/ HTTP\/1.1",
"request_sample": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3c7bdbe6b826f5f8d3ca64d0840dd6bced27985",
"protocol_details": {
"http_method": "GET",
"http_path": "\/bea_wls_internal\/",
"request_line": "GET \/bea_wls_internal\/ HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/bea_wls_internal\/",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/bea_wls_internal\/",
"request_line": "GET \/bea_wls_internal\/ HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/bea_wls_internal\/",
"evidence_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
81,
199,
548,
1720,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /_async/AsyncResponseService
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /_async/AsyncResponseService UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CVE-2019-2725 WebLogic CVE-2019-2725
Ligne de requête
GET /_async/AsyncResponseService HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.02609206894104,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f",
"event_fingerprint": "b2624b0e4471fbbf800f6475da10222096755cc4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0179"
],
"matched_pattern_names": [
"CVE-2019-2725 WebLogic CVE-2019-2725"
],
"pattern_ids": [
"pat-0179"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "f46c83e962920586c0f27a7fc3db2558",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/_async\/AsyncResponseService",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/_async\/AsyncResponseService",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb765f4bafba41d20cfc6705facde5db73ecc7ca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /wls-wsat/CoordinatorPortType
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /wls-wsat/CoordinatorPortType UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_probe_weblogic_wls
Cible HTTP
GET
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
WebLogic wls-wsat
Ligne de requête
GET /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 107,
"payload_entropy": 5.057474763414213,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "9a13839e361d7a021b1792ac4f054c4cd3837a93",
"event_fingerprint": "af8fe99e3af1262506b6c57904f48eff4e2bbd3c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0602"
],
"matched_pattern_names": [
"WebLogic wls-wsat"
],
"pattern_ids": [
"pat-0602"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "888a0551366fdb0e2c778f40b89466b9",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38b506daea38c8c8cc5e3f2a3b9ec1ba9d7e25c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_probe_weblogic_wls",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /console/login/LoginForm.jsp
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /console/login/LoginForm.jsp UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_probe_console
Cible HTTP
GET
/console/login/LoginForm.jsp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/console/login/LoginForm.jsp
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
ET WebLogic console
WebLogic console path
WebLogic cluster
Probe /console/
Ligne de requête
GET /console/login/LoginForm.jsp HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /console/login/LoginForm.jsp HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "jsp",
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.010663087588212,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc",
"event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"matched_pattern_names": [
"ET WebLogic console",
"WebLogic console path",
"WebLogic cluster",
"Probe \/console\/"
],
"pattern_ids": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "35dc329ce3f6aab88c2a34aa8b61dbcc",
"path_pattern_hash": "787be5555f9e6e61f95410bb9176809f"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a249b8ed14ccb256413b17575441962a63d85092",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_probe_console",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA curl/8.18.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 79,
"payload_entropy": 4.808677786930841,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "76a34fae6cdf27dbce726d0e01d7bb35bd87f3e8",
"event_fingerprint": "376abaf7e39dc177b1f8bb2aae32add1c2ac03cc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "b393ba726e0e8ede8aeb3584978e4511",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76b3b090baa789989050428a498b948633c9c222",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /_async/AsyncResponseService
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /_async/AsyncResponseService UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CVE-2019-2725 WebLogic CVE-2019-2725
Ligne de requête
GET /_async/AsyncResponseService HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.02609206894104,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f",
"event_fingerprint": "b2624b0e4471fbbf800f6475da10222096755cc4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0179"
],
"matched_pattern_names": [
"CVE-2019-2725 WebLogic CVE-2019-2725"
],
"pattern_ids": [
"pat-0179"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "f46c83e962920586c0f27a7fc3db2558",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/_async\/AsyncResponseService",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/_async\/AsyncResponseService",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb765f4bafba41d20cfc6705facde5db73ecc7ca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /wls-wsat/CoordinatorPortType
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /wls-wsat/CoordinatorPortType UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_probe_weblogic_wls
Cible HTTP
GET
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
WebLogic wls-wsat
Ligne de requête
GET /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 107,
"payload_entropy": 5.057474763414213,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "9a13839e361d7a021b1792ac4f054c4cd3837a93",
"event_fingerprint": "af8fe99e3af1262506b6c57904f48eff4e2bbd3c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0602"
],
"matched_pattern_names": [
"WebLogic wls-wsat"
],
"pattern_ids": [
"pat-0602"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "888a0551366fdb0e2c778f40b89466b9",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38b506daea38c8c8cc5e3f2a3b9ec1ba9d7e25c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_probe_weblogic_wls",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance) · → /console/login/LoginForm.jsp
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /console/login/LoginForm.jsp UA curl/8.18.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_probe_console
Cible HTTP
GET
/console/login/LoginForm.jsp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/console/login/LoginForm.jsp
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
ET WebLogic console
WebLogic console path
WebLogic cluster
Probe /console/
Ligne de requête
GET /console/login/LoginForm.jsp HTTP/1.1
User-Agent
curl/8.18.0
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /console/login/LoginForm.jsp HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: curl/8.18.0
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "jsp",
"http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.010663087588212,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 43,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc",
"event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"matched_pattern_names": [
"ET WebLogic console",
"WebLogic console path",
"WebLogic cluster",
"Probe \/console\/"
],
"pattern_ids": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "87da89131acc05cb861c80340d3d7610",
"payload_hash": "35dc329ce3f6aab88c2a34aa8b61dbcc",
"path_pattern_hash": "787be5555f9e6e61f95410bb9176809f"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "curl\/8.18.0",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a249b8ed14ccb256413b17575441962a63d85092",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 43,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "curl\/8.18.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: *\/*",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
81,
111,
135,
199,
445,
548,
1025,
1720,
1723,
6001,
7001,
8080,
8888
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_probe_console",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8080 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 67,
"payload_entropy": 4.654964750995319,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1952973b298753bacd8311ca7b61685d03229984",
"event_fingerprint": "1a73e52fcb0af206bdd873fdc276f059b19b837a",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84de652504b56efe8de0bfc43206a7087f4f121c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:81 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 67,
"payload_entropy": 4.654964750995319,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 81,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c19c2f4ff3fb5468d74dc878620d95d99e047516",
"event_fingerprint": "71966f4e7329013dca27ba512562d6a0d100c0ea",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46b6c21bb6aee72c13bc42816e7f90e0cf302d87",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
199 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:199 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
199
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 67,
"payload_entropy": 4.654964750995319,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 199,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c781537e1814856434ff01b22fc1bf0d1bfdd354",
"event_fingerprint": "9521c9a82939c8d82a6e4de472d0fd6bf9c73e00",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 199,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20e6426ae637e7c591c90879da91347736fdb32b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 199,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1720 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1720 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1720
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 67,
"payload_entropy": 4.654964750995319,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 1720,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3508f737fa4edc0eec52a0cfb4a57e74dd00d0de",
"event_fingerprint": "ea58eea66a22312e866acfe278d640d1f8aac7f7",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1720,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "83b076089514a0046d7cf20908a486188cf009df",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1720,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1720"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8888 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 67,
"payload_entropy": 4.654964750995319,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "05c58c5f19ad288de9a49d67ac759a6d356e63bd",
"event_fingerprint": "80f2aa9a52b555c26e5706a111edbf5b4c7d378f",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "345b9906e5780ebe962dc35e5942256a3e5435ac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� (R� ���35
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (R� ���35
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 2.0057587693095926,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05",
"event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ef119654acaa9ddd31bb6b11d557d787",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2156d45a0666edd6fb36d667eb6175f5c54b36b7",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(R\ufffd\ufffd\ufffd\ufffd35",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(R\ufffd\ufffd\ufffd\ufffd35",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_mongodb_probe"
]
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� (Z� ���N�
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (Z� ���N�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 2.1138243943587627,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05",
"event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "249ed8eee1c2bca431337b23f0da8bfd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15e4e1254e0a33f372d2e63a24f0933b6ff039cd",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(Z\ufffd\ufffd\ufffd\ufffdN\ufffd",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(Z\ufffd\ufffd\ufffd\ufffdN\ufffd",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_mongodb_probe"
]
}
|
|
|
TCP |
1025 · TERADATA
|
teradata
|
Scan de ports
port scan syn · via TERADATA:1025 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TERADATA
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_teradata_probe
teradata_emulated
teradata_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1025
Chemin / cible
—
Service
TERADATA
Payload
� (F�2� ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (F�2� ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0000000000000000",
"emulator_response_len": 12,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "teradata",
"app_proto": "teradata",
"asn": 212238,
"country": "JP",
"dst_port": 1025,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ce63e0435125cbad53c3ad478c4501690cfa39b6",
"event_fingerprint": "a85579a7a3e45f06afb902a019cc7327fde3a2f5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "teradata",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ccb74f2b059a88995e2c13f370275514",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1025,
"service": "teradata",
"service_name": "teradata",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1127b4cfd5b233b814de9108208e6f515e42b6dd",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1025,
"service": "teradata",
"service_label_fr": "TERADATA"
},
"evidence_snippet": "\ufffd(F\ufffd2\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via TERADATA:1025 \u00b7 (reconnaissance)",
"target_port_label": "1025 \u00b7 TERADATA",
"emulator_service": "teradata",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TERADATA \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "teradata",
"service_label_fr": "TERADATA",
"dst_port": 1025,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-teradata",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1025,
"service": "teradata",
"service_label_fr": "TERADATA"
},
"attack_vector": "port scan syn \u00b7 via TERADATA:1025 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(F\ufffd2\ufffd\ufffd\ufffd",
"target_port_label": "1025 \u00b7 TERADATA",
"emulator_service": "teradata",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "teradata",
"service_banner": "honeypot-teradata",
"service_os": "linux",
"dst_port": "1025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 1.81,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_teradata_probe",
"teradata_emulated",
"teradata_payload"
]
}
|
|
|
TCP |
445 · SMB
|
smb
|
Scan de ports
port scan syn · via SMB:445 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SMB
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_bruteforce
net_smb_probe
smb_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
445
Chemin / cible
—
Service
SMB
Payload
� (:�@ ��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (:�@ ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000048",
"emulator_response_len": 4,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "smb",
"app_proto": "smb",
"asn": 212238,
"country": "JP",
"dst_port": 445,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4560951323ba5b3a6a7907c70c916357c8828769",
"event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "smb",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6d8648da51e54bedd26a884173e55eb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 445,
"service": "smb",
"service_name": "smb",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af1c062d0c0a5ded6ceac4080002ec9731e3af4e",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 445,
"service": "smb",
"service_label_fr": "SMB"
},
"evidence_snippet": "\ufffd(:\ufffd@\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via SMB:445 \u00b7 (reconnaissance)",
"target_port_label": "445 \u00b7 SMB",
"emulator_service": "smb",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SMB \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "smb",
"service_label_fr": "SMB",
"dst_port": 445,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-smb",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 445,
"service": "smb",
"service_label_fr": "SMB"
},
"attack_vector": "port scan syn \u00b7 via SMB:445 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(:\ufffd@\ufffd\ufffd",
"target_port_label": "445 \u00b7 SMB",
"emulator_service": "smb",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "smb",
"service_banner": "honeypot-smb",
"service_os": "linux",
"dst_port": "445"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.01,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_bruteforce",
"net_smb_probe",
"smb_emulated"
]
}
|
|
|
TCP |
6001 · X11
|
x11
|
Scan de ports
port scan syn · via X11:6001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
X11
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6001
Chemin / cible
—
Service
X11
Payload
� ( J\� ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ( J\� ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742078313120726561647920706f72743d363030310d0a",
"emulator_response_len": 34,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "x11",
"app_proto": "x11",
"asn": 212238,
"country": "JP",
"dst_port": 6001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4a57156e8ef1463662de16921041f4d7cce03333",
"event_fingerprint": "68d1dd076fb0197faf30ecf6b04beb0759fee0bb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "x11",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f3836379654812e48b25d82c62ad3f2f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6001,
"service": "x11",
"service_name": "x11",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a8b17a098ebd49baedb9fb850e9ada3f748f39f",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 6001,
"service": "x11",
"service_label_fr": "X11"
},
"evidence_snippet": "\ufffd( J\\\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
"target_port_label": "6001 \u00b7 X11",
"emulator_service": "x11",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "x11",
"service_label_fr": "X11",
"dst_port": 6001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-x11",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 6001,
"service": "x11",
"service_label_fr": "X11"
},
"attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd( J\\\ufffd\ufffd\ufffd",
"target_port_label": "6001 \u00b7 X11",
"emulator_service": "x11",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "x11",
"service_banner": "honeypot-x11",
"service_os": "linux",
"dst_port": "6001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 2.21,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_mongodb_probe"
]
}
|
|
|
TCP |
135 · MSRPC
|
msrpc
|
Scan de ports
port scan syn · via MSRPC:135 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
MSRPC
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
135
Chemin / cible
—
Service
MSRPC
Payload
� (z� ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (z� ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206d7372706320726561647920706f72743d3133350d0a",
"emulator_response_len": 35,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "msrpc",
"app_proto": "msrpc",
"asn": 212238,
"country": "JP",
"dst_port": 135,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e8150bd3a3273a7f243736803d5c3834f10913be",
"event_fingerprint": "7121eff0ac90f78b66b61eb5b339241632ad42e0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "msrpc",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "660b573881194d2d021d9e8d5470ace7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 135,
"service": "msrpc",
"service_name": "msrpc",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d9ac31912c3ab0e0322ffb339e54419b2952d04",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 135,
"service": "msrpc",
"service_label_fr": "MSRPC"
},
"evidence_snippet": "\ufffd(z\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via MSRPC:135 \u00b7 (reconnaissance)",
"target_port_label": "135 \u00b7 MSRPC",
"emulator_service": "msrpc",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSRPC \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "msrpc",
"service_label_fr": "MSRPC",
"dst_port": 135,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-msrpc",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 135,
"service": "msrpc",
"service_label_fr": "MSRPC"
},
"attack_vector": "port scan syn \u00b7 via MSRPC:135 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(z\ufffd\ufffd\ufffd",
"target_port_label": "135 \u00b7 MSRPC",
"emulator_service": "msrpc",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "msrpc",
"service_banner": "honeypot-msrpc",
"service_os": "linux",
"dst_port": "135"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1723 · PPTP
|
pptp
|
Scan de ports
port scan syn · via PPTP:1723 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
PPTP
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_port_scan_fast
pptp_emulated
pptp_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1723
Chemin / cible
—
Service
PPTP
Payload
� (3tB� ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (3tB� ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "009a000100000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"emulator_response_len": 152,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "pptp",
"app_proto": "pptp",
"asn": 212238,
"country": "JP",
"dst_port": 1723,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8632c0f3a4befa9502f68e1a5ec91935f80f98d1",
"event_fingerprint": "904dec90409cdde746c8f5ac626df5ddf2796f9b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "pptp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "163c6bf475bf2b383a08f33afee9360e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1723,
"service": "pptp",
"service_name": "pptp",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4020c42322c0c71abe88696e11bfb9c671917e2c",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1723,
"service": "pptp",
"service_label_fr": "PPTP"
},
"evidence_snippet": "\ufffd(3tB\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)",
"target_port_label": "1723 \u00b7 PPTP",
"emulator_service": "pptp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PPTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "pptp",
"service_label_fr": "PPTP",
"dst_port": 1723,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pptp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1723,
"service": "pptp",
"service_label_fr": "PPTP"
},
"attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(3tB\ufffd\ufffd\ufffd",
"target_port_label": "1723 \u00b7 PPTP",
"emulator_service": "pptp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pptp",
"service_banner": "honeypot-pptp",
"service_os": "linux",
"dst_port": "1723"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_port_scan_fast",
"pptp_emulated",
"pptp_payload"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8888 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "05c58c5f19ad288de9a49d67ac759a6d356e63bd",
"event_fingerprint": "80f2aa9a52b555c26e5706a111edbf5b4c7d378f",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c678bbbbb221fad8612434ce5af0a6ae1198d551",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� (p�� �� �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (p�� ��
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 2.1138243943587627,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c3e25cab9917244e5288b3322c2bce33c9505d78",
"event_fingerprint": "7890ff4d1c4cb9540f6f6ccebb3623a9e91cbbbd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ecb4a8d12632075758d4eac427055e6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abbedd2698ec7d9342c150512a762743c17076f6",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(p\ufffd\ufffd\ufffd\ufffd\n\ufffd",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(p\ufffd\ufffd\ufffd\ufffd\n\ufffd",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_port_scan_fast"
]
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� (�=� ��.hG
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (�=� ��.hG
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 2.0683698489042173,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c3e25cab9917244e5288b3322c2bce33c9505d78",
"event_fingerprint": "7890ff4d1c4cb9540f6f6ccebb3623a9e91cbbbd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ed546dbdfa464899c307676ad848a5fc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8f65ade21ac3e291463bdcf107a8f353a43b004",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(\ufffd=\ufffd\ufffd\ufffd.hG",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(\ufffd=\ufffd\ufffd\ufffd.hG",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_port_scan_fast"
]
}
|
|
|
TCP |
548 · AFP
|
afp
|
Scan de ports
port scan syn · via AFP:548 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
AFP
WAF
—
Recommandation
Surveiller
Tags
afp_emulated
afp_payload
mongodb_probe
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
548
Chemin / cible
—
Service
AFP
Payload
� ([d� ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ([d� ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01040000000000000000000041465056657273696f6e20332e330d10000612000000",
"emulator_response_len": 34,
"bytes_in": 44,
"payload_entropy": 1.630681483663912,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "afp",
"app_proto": "afp",
"asn": 212238,
"country": "JP",
"dst_port": 548,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "66f5e9ebe6f0ac7ef886fec425432536b06ae217",
"event_fingerprint": "48f198e90269326e36107de80ad6deccecbf7a78",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "afp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "64f7162c8cbe9eef55a1c1bdcd1d61ad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 548,
"service": "afp",
"service_name": "afp",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52272e75d6bbe418e95454979b36dc17aea0bc35",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 548,
"service": "afp",
"service_label_fr": "AFP"
},
"evidence_snippet": "\ufffd([d\ufffd\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)",
"target_port_label": "548 \u00b7 AFP",
"emulator_service": "afp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AFP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "afp",
"service_label_fr": "AFP",
"dst_port": 548,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-afp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 548,
"service": "afp",
"service_label_fr": "AFP"
},
"attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd([d\ufffd\ufffd\ufffd",
"target_port_label": "548 \u00b7 AFP",
"emulator_service": "afp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "afp",
"service_banner": "honeypot-afp",
"service_os": "linux",
"dst_port": "548"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.51,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"afp_emulated",
"afp_payload",
"mongodb_probe",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /Nmap/folder/check1784352718
|
Élevée
|
Moyen · 60
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Nmap/folder/check1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/Nmap/folder/check1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /Nmap/folder/check1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080
Connection: close
User-Agent:
Requête brute (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "52f07e08fde357a7f4b6e144985f039d8b76dc77",
"http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.241091275368707,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 8,
"anomaly_count": 1,
"campaign_key": "244aeb3457260b8becfb01c5a8288c41144d3bc9",
"event_fingerprint": "90348e19e9284dd437cb833a630f7cfc6cc9e834",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "b4729141c1331044bd8879e137fbedfd",
"path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: ",
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94443ef900bd50b533c925b73de2c2f32eed1738",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.88,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� ( �?V ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ( �?V ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 1.7776134368191159,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05",
"event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c40fae1fcc2f70ead1e5987a6041a416",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26d72ab9f2926cdf1aaef1f002bb504277e1a179",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(\t\ufffd?V\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(\t\ufffd?V\ufffd\ufffd",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.88,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_mongodb_probe"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8888 · (sonde / probe) · → /NmapUpperCheck1784352718
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/NmapUpperCheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/NmapUpperCheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
HTTP alt 8888 probe
Ligne de requête
GET /NmapUpperCheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888
Connection: close
User-Agent: Moz
Requête brute (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1",
"http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.215808511235892,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8888,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "b3282692df2834ba30fc5caa3c2533845a71cd48",
"event_fingerprint": "e48fcbe01853fa5d3bef1234a96c2b5c7e93c793",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "fe9d84c16810991e0ed6ea8fb4180f37",
"path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8b7c909c0dcfb8047a8ad5c09fdda91bd480e2e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz",
"attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.75,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:81 · (sonde / probe) · → /NmapUpperCheck1784352718
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/NmapUpperCheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/NmapUpperCheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /NmapUpperCheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81
Connection: close
User-Agent: Mozil
Requête brute (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f",
"http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.21243235238441,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 81,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "67fe9b83623439dff030f5db0a8dd1729a7738c9",
"event_fingerprint": "ea776d0418c2c5be6e4adbc432096c2d57b653fc",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "7a146d5a43a32269aacf925feafbdaea",
"path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"evidence": {
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d23ecff62d0c82a107fe460d5bf9e52e514bdaf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
1720 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1720 · (reconnaissance) · → /evox/about
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/evox/about
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1720
Chemin / cible
/evox/about
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Probe /evox/about
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /evox/about HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /evox/about HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720
Connection: close
User-Agent: Mozilla/5.0 (comp
Requête brute (extrait)
GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf",
"http_target_hash": "9e931bb53b054c2fff95daa013fecdd4ca2a01a2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 194,
"payload_entropy": 5.156657139436861,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 1720,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 60,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "ff42e7281b45d1d95158b7b06938f3ea5e80a7ce",
"event_fingerprint": "352bb29008b308eb655ec72e181819d9b7639942",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0255",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"Probe \/evox\/about",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0103",
"pat-0255",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "120f4f2570a7a162d7023c0bbf1414ba",
"path_pattern_hash": "6c06e7a5a57aea56adce71b0743fb577"
},
"target_context": {
"dst_port": 1720,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp",
"method": "GET",
"path": "\/evox\/about",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/evox\/about HTTP\/1.1",
"request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp",
"evidence": {
"method": "GET",
"path": "\/evox\/about",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/evox\/about HTTP\/1.1",
"request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "120b1f470d2be3727bcbe8ba64613aa100c315ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/evox\/about",
"request_line": "GET \/evox\/about HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp",
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1720,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/evox\/about",
"request_line": "GET \/evox\/about HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about",
"evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1720"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.72,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
1720 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1720 · (reconnaissance) · → /HNAP1
|
Élevée
|
Moyen · 59
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/HNAP1
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1720
Chemin / cible
/HNAP1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /HNAP1 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /HNAP1 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720
Connection: close
User-Agent: Mozilla/5.0 (compatibl
Requête brute (extrait)
GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf",
"http_target_hash": "92c22322858be108c9b5ebcfd6f2c3cb5ceee211",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 189,
"payload_entropy": 5.165823708932025,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 1720,
"risk_waf": 96,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "a5697c8efd47cb0d8f75f9e56bafac486c24bbb1",
"event_fingerprint": "7dafdbdf1babff5c47a316c50d537b526037b3f2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "a7760b7b0d7ff2e11b5594ea442d5d26",
"path_pattern_hash": "6fce0d6d2998b47f09e54396e5a34d07"
},
"target_context": {
"dst_port": 1720,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl",
"method": "GET",
"path": "\/HNAP1",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/HNAP1 HTTP\/1.1",
"request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl",
"evidence": {
"method": "GET",
"path": "\/HNAP1",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/HNAP1 HTTP\/1.1",
"request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fec71780b5657eb5071ad97de8a75de2dc981c78",
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1",
"request_line": "GET \/HNAP1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl",
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1720,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1",
"request_line": "GET \/HNAP1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1",
"evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1720"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.72,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"iot_http_endpoint",
"scanner-ua"
]
}
|
|
|
TCP |
199 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:199 · (reconnaissance) · → /HNAP1
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/HNAP1
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
199
Chemin / cible
/HNAP1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /HNAP1 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /HNAP1 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199
Connection: close
User-Agent: Mozilla/5.0 (compatible
Requête brute (extrait)
GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8",
"http_target_hash": "92c22322858be108c9b5ebcfd6f2c3cb5ceee211",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 188,
"payload_entropy": 5.160076885254946,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 199,
"risk_waf": 96,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 58,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "88cb7d75b6f30b4d9e48344e68d4546132e148f2",
"event_fingerprint": "5ad7ca389dffebc96b301c303c47ae707431bcc1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 58,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "00a9de5a0b64c157d3b97549ff50e07a",
"path_pattern_hash": "6fce0d6d2998b47f09e54396e5a34d07"
},
"target_context": {
"dst_port": 199,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible",
"method": "GET",
"path": "\/HNAP1",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/HNAP1 HTTP\/1.1",
"request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible",
"evidence": {
"method": "GET",
"path": "\/HNAP1",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/HNAP1 HTTP\/1.1",
"request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "717ab86f9327dc51d6f9af3a2eae0a2771b548d5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1",
"request_line": "GET \/HNAP1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible",
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 58,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 199,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1",
"request_line": "GET \/HNAP1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1",
"evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.71,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"iot_http_endpoint",
"scanner-ua"
]
}
|
|
|
TCP |
199 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:199 · (reconnaissance) · → /evox/about
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/evox/about
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
199
Chemin / cible
/evox/about
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Probe /evox/about
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /evox/about HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /evox/about HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199
Connection: close
User-Agent: Mozilla/5.0 (compa
Requête brute (extrait)
GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8",
"http_target_hash": "9e931bb53b054c2fff95daa013fecdd4ca2a01a2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 193,
"payload_entropy": 5.150816007053635,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 199,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 60,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "64e4450163e4462a9a22fb4ba44ffe3ec0303e50",
"event_fingerprint": "609ab42f55a36fa9e9203da8c948d730286aebdc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0255",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"Probe \/evox\/about",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0103",
"pat-0255",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "66eecce44162ed095e3acf941ba682be",
"path_pattern_hash": "6c06e7a5a57aea56adce71b0743fb577"
},
"target_context": {
"dst_port": 199,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa",
"method": "GET",
"path": "\/evox\/about",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/evox\/about HTTP\/1.1",
"request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa",
"evidence": {
"method": "GET",
"path": "\/evox\/about",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/evox\/about HTTP\/1.1",
"request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcf1a3c2e6b149dd42838a2242ce6c9d7944fdc4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/evox\/about",
"request_line": "GET \/evox\/about HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa",
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 199,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/evox\/about",
"request_line": "GET \/evox\/about HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about",
"evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.71,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /NmapUpperCheck1784352718
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/NmapUpperCheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/NmapUpperCheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /NmapUpperCheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080
Connection: close
User-Agent: Moz
Requête brute (extrait)
GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "52f07e08fde357a7f4b6e144985f039d8b76dc77",
"http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.2230670449105405,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8080,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "973d8923003acbae0aa82479b53e1238c798b4d6",
"event_fingerprint": "96db8e09f07c507dd15fb13d8bb8176668528581",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "626492d62151159b7cd1f36fda022065",
"path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/NmapUpperCheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c98efbb9319b578eaa941906c9b27916295acd2c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/NmapUpperCheck1784352718",
"request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718",
"evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.7,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
111 · RPCBIND
|
rpcbind
|
Scan de ports
port scan syn · via RPCBIND:111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
RPCBIND
WAF
—
Recommandation
Surveiller
Tags
mongodb_probe
net_mongodb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
111
Chemin / cible
—
Service
RPCBIND
Payload
� (B�r ��
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
NFS RPC mount
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� (B�r ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a",
"emulator_response_len": 37,
"bytes_in": 44,
"payload_entropy": 1.8230679822736615,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "rpcbind",
"app_proto": "rpcbind",
"asn": 212238,
"country": "JP",
"dst_port": 111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05",
"event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0532",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rpcbind",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb44d60c223c3809f4b7cb40cfa7484e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 111,
"service": "rpcbind",
"service_name": "rpcbind",
"risk_score": 42
},
"payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b2adfd97bf4f11261b8b01a15d4628e222e4dc7",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"evidence_snippet": "\ufffd(B\ufffdr\ufffd\ufffd",
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rpcbind",
"service_label_fr": "RPCBIND",
"dst_port": 111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rpcbind",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 111,
"service": "rpcbind",
"service_label_fr": "RPCBIND"
},
"attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd(B\ufffdr\ufffd\ufffd",
"target_port_label": "111 \u00b7 RPCBIND",
"emulator_service": "rpcbind",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rpcbind",
"service_banner": "honeypot-rpcbind",
"service_os": "linux",
"dst_port": "111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.69,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_probe",
"net_mongodb_probe"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8888 · (sonde / probe) · → /Nmap/folder/check1784352718
|
Élevée
|
Moyen · 61
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Nmap/folder/check1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/Nmap/folder/check1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
HTTP alt 8888 probe
Ligne de requête
GET /Nmap/folder/check1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888
Connection: close
User-Agent:
Requête brute (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1",
"http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.233935943594646,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8888,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 1,
"campaign_key": "bde0b4fdbbb586954811f2b26316f35176a7bda0",
"event_fingerprint": "f04ee0098cf2636a0cbdcc4be6fa5815c3432ba4",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "e2b46acfa36b9eadee6c3807a14d203b",
"path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: ",
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d31d43a8c2e36b58755a57d8053fb90b9344fdba",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:",
"attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.97,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:81 · (sonde / probe) · → /Nmap/folder/check1784352718
|
Élevée
|
Moyen · 60
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Nmap/folder/check1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/Nmap/folder/check1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /Nmap/folder/check1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81
Connection: close
User-Agent: Mo
Requête brute (extrait)
GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f",
"http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.230583066573612,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 8,
"anomaly_count": 1,
"campaign_key": "d63ab01dcc4f08dc61467dd9216c950adb0fcc51",
"event_fingerprint": "d2eea910060b0152a36f871de6fc79ed65badd72",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "cd95758931d35ddac90eefe3e3b2f93e",
"path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo",
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo",
"evidence": {
"method": "GET",
"path": "\/Nmap\/folder\/check1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c517b4155bdbccbf391e2344036d008f013122a9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo",
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Nmap\/folder\/check1784352718",
"request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718",
"evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.94,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8888 · (reconnaissance) · → /sdk
|
Élevée
|
Élevé · 77
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
TA0043
TA0001
Protocole
POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950079:sqli-19
950326:rce-0
950327:rce-0
950406:ssrf-3
Cible HTTP
POST
/sdk
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8888
Chemin / cible
/sdk
Pourquoi cette classification : Motif SSRF · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Élevé
· 77
Confiance : Confiance 100 % — 8 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 941130
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
HTTP alt 8888 probe
Ligne de requête
POST /sdk HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
sqli-19
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
POST /sdk HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888
Content-Length: 441
Connection: close
User-Agent: Mo
Requête brute (extrait)
POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Content-Length: 441 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) <soap:Envelope xmlns:xsd="http://www.w3.org/200
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1",
"http_target_hash": "5e2a035222ca1432dd7a4c0062da7711ee276c61",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 650,
"payload_entropy": 5.282456176509406,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 8888,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 15,
"risk_granularity": 6.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 77,
"tag_count": 13,
"anomaly_count": 1,
"campaign_key": "a9edf7102c063c042b9a56b8ce12af2e8832e766",
"event_fingerprint": "044c5d88fb789cabb4309883d24717947aefc841",
"classification_reason": "Motif SSRF \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842",
"pat-0284",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 941130",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0284",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543",
"pat-0599"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 77,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "0c84863091b62cdb1dba23d38ffd4696",
"path_pattern_hash": "b91a94364e548eac8280a672094b6c64"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo",
"method": "POST",
"path": "\/sdk",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"sqli-19",
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "POST \/sdk HTTP\/1.1",
"request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/200",
"payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo",
"evidence": {
"method": "POST",
"path": "\/sdk",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"sqli-19",
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "POST \/sdk HTTP\/1.1",
"request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/200",
"payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo",
"classification_reason": "Motif SSRF \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b92f122a53a59b865677b09cad01a5724d680fa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/sdk",
"request_line": "POST \/sdk HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo",
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 100%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 77,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/sdk",
"request_line": "POST \/sdk HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk",
"evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"anomaly:scanner-ua",
"http_jwt_body",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
199 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:199 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
199
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 199,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a07359c200665fd7add17fabfe9779a8f087b469",
"event_fingerprint": "ce401735047c79e55eacb1c06be224bc51320f5c",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 199,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e6c836d61bb8bafd6eb82315767bcbb3ddc68cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 199,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.8,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:81 · (sonde / probe) · → /nmaplowercheck1784352718
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/nmaplowercheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/nmaplowercheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /nmaplowercheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81
Connection: close
User-Agent: Mozil
Requête brute (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f",
"http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.2029916728697305,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 81,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "67fe9b83623439dff030f5db0a8dd1729a7738c9",
"event_fingerprint": "e5a327c946bac23dbec004b040f34070b2d983a7",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "ee04a59b66a99bae1f05e6c3da1e325f",
"path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"evidence": {
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72cca0a83266f06cbcd4ec43c3fe0d9c9eb3615a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.06,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:81 · (reconnaissance) · → /sdk
|
Élevée
|
Élevé · 76
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
TA0043
TA0001
Protocole
POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950079:sqli-19
950326:rce-0
950327:rce-0
950406:ssrf-3
Cible HTTP
POST
/sdk
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
81
Chemin / cible
/sdk
Pourquoi cette classification : Motif SSRF · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 76
Confiance : Confiance 100 % — 8 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 941130
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
POST /sdk HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
sqli-19
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
POST /sdk HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81
Content-Length: 441
Connection: close
User-Agent: Mozi
Requête brute (extrait)
POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Content-Length: 441 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) <soap:Envelope xmlns:xsd="http://www.w3.org/2001/
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f",
"http_target_hash": "5e2a035222ca1432dd7a4c0062da7711ee276c61",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 648,
"payload_entropy": 5.271108735971403,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 15,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 76,
"tag_count": 13,
"anomaly_count": 1,
"campaign_key": "b0eb79ddaff70a8662e8b1b5d957b57842b65f9e",
"event_fingerprint": "3bd20c458e6da8af13dfa8c2a8ec64794ce0b5c7",
"classification_reason": "Motif SSRF \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842",
"pat-0284",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 941130",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0842",
"pat-0284",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 76,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "13c516e06f7703ef1de5c499f0f6513c",
"path_pattern_hash": "b91a94364e548eac8280a672094b6c64"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi",
"method": "POST",
"path": "\/sdk",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"sqli-19",
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "POST \/sdk HTTP\/1.1",
"request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/2001\/",
"payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi",
"evidence": {
"method": "POST",
"path": "\/sdk",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"sqli-19",
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "POST \/sdk HTTP\/1.1",
"request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/2001\/",
"payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi",
"classification_reason": "Motif SSRF \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73155d17ba1f23ed972aaca4453f7b1c5b898144",
"protocol_details": {
"http_method": "POST",
"http_path": "\/sdk",
"request_line": "POST \/sdk HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi",
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 100%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 76,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/sdk",
"request_line": "POST \/sdk HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk",
"evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.06,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950326:rce-0",
"950327:rce-0",
"950406:ssrf-3",
"950407:ssrf-3",
"950470:nosqli-3",
"950471:nosqli-3",
"anomaly:scanner-ua",
"http_jwt_body",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
199 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:199 · (sonde / probe) · → /nmaplowercheck1784352718
|
Élevée
|
Moyen · 57
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/nmaplowercheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
199
Chemin / cible
/nmaplowercheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /nmaplowercheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199
Connection: close
User-Agent: Mozi
Requête brute (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8",
"http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.225622530028717,
"port_category": "well_known",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 199,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 57,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "c5fcbd9502a0674d01b705e8f7378361dd03fc86",
"event_fingerprint": "d4c4f258616e019b4603d9c20c3854eae8824fac",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "0256d0ee6e310484b93ebc187eb40071",
"path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341"
},
"target_context": {
"dst_port": 199,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi",
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi",
"evidence": {
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2dbdf703c92af9132d92f744317087347b73291a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi",
"attack_vector": "scanner vuln \u00b7 via HTTP:199 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 199,
"protocol_emulated": null,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 199,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:199 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi",
"target_port_label": "199 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.06,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
1720 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1720 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1720
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 1720,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "2b7998c4ade4362021bbaf19219a9857622038d3",
"event_fingerprint": "b0da2a9edddbb989ddc1033f6079605bf6efa436",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1720,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21890f6f004d56bff401597c330f7362c8883f16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1720,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1720"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.32,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua"
]
}
|
|
|
TCP |
1723 · PPTP
|
pptp
|
Scan de ports
port scan syn · via PPTP:1723 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
PPTP
WAF
—
Recommandation
Surveiller
Tags
net_pptp_probe
pptp_emulated
pptp_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1723
Chemin / cible
—
Service
PPTP
Payload
� +<M �� none nmap
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
UA nmap
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� +<M �� none nmap
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "009a000100000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"emulator_response_len": 152,
"bytes_in": 156,
"payload_entropy": 1.0185126797061423,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "pptp",
"app_proto": "pptp",
"asn": 212238,
"country": "JP",
"dst_port": 1723,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7f571a2fce7c469bfc57d5e48b3a69201915b70e",
"event_fingerprint": "71584713bb04b570046daaa2c28d60858e61192a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0448",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"UA nmap",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0448",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "pptp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4dd04af3dcb43d86d479b61344c6ee22",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1723,
"service": "pptp",
"service_name": "pptp",
"risk_score": 42
},
"payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbe7bccd2ad2e1096217ff77f84a57df6591ce0b",
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1723,
"service": "pptp",
"service_label_fr": "PPTP"
},
"evidence_snippet": "\ufffd+<M\ufffd\ufffdnonenmap",
"attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)",
"target_port_label": "1723 \u00b7 PPTP",
"emulator_service": "pptp",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PPTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "pptp",
"service_label_fr": "PPTP",
"dst_port": 1723,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pptp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1723,
"service": "pptp",
"service_label_fr": "PPTP"
},
"attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd+<M\ufffd\ufffdnonenmap",
"target_port_label": "1723 \u00b7 PPTP",
"emulator_service": "pptp",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pptp",
"service_banner": "honeypot-pptp",
"service_os": "linux",
"dst_port": "1723"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.58,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_pptp_probe",
"pptp_emulated",
"pptp_payload"
]
}
|
|
|
TCP |
1720 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:1720 · (sonde / probe) · → /nmaplowercheck1784352718
|
Élevée
|
Moyen · 57
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1595
TA0007
TA0001
Protocole
GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
scanner-ua
Cible HTTP
GET
/nmaplowercheck1784352718
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1720
Chemin / cible
/nmaplowercheck1784352718
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
ET-SCAN-Nmap
SIGMA-web-scanner-ua
pat-0805
pat-0425
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MITRE T1046 network scan
LFI Double-dot bypass
UA Nmap Scripting Engine
UA nmap
Sigma nmap UA
Ligne de requête
GET /nmaplowercheck1784352718 HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
scanner-ua
Payload (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720
Connection: close
User-Agent: Moz
Requête brute (extrait)
GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1",
"http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf",
"http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.214321453752121,
"port_category": "registered",
"org": "Datacamp Limited",
"service": "http",
"app_proto": "http",
"asn": 212238,
"country": "JP",
"dst_port": 1720,
"risk_waf": 96,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 57,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "bb307085f48b1abf02f743997447d433cdc7dff6",
"event_fingerprint": "1bcb6317239ca02a9074c1f975ff05f9a1ea2a5c",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 328,
"precision_signals": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"kb_rule_ids": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_patterns": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"matched_pattern_names": [
"MITRE T1046 network scan",
"LFI Double-dot bypass",
"UA Nmap Scripting Engine",
"UA nmap",
"Sigma nmap UA"
],
"pattern_ids": [
"pat-0805",
"pat-0103",
"pat-0425",
"pat-0448",
"pat-0543"
],
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 212238,
"org": "Datacamp Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "330447dbae11331605ae65a34cb11832",
"payload_hash": "04fafe41f17a887abb2448d62b1a61bc",
"path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341"
},
"target_context": {
"dst_port": 1720,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/nmaplowercheck1784352718",
"user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n",
"payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b69f6cad6448af88d7d2e4ae8c84badad312032d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz",
"attack_vector": "scanner vuln \u00b7 via HTTP:1720 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 57,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1720,
"protocol_emulated": null,
"tags_summary": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"tags_summary_labels_fr": [
"ET-SCAN-Nmap",
"SIGMA-web-scanner-ua",
"pat-0805",
"pat-0425"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nmaplowercheck1784352718",
"request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)",
"port": 1720,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:1720 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718",
"evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz",
"target_port_label": "1720 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1720"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
21,
22,
23,
81,
110,
111,
135,
143,
199,
445,
465,
548,
587,
993,
995,
1025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.58,
"multi_protocol_correlation": true,
"multi_protocol_count": 23,
"multi_protocol_sample": [
"afp",
"ftp",
"h323",
"http",
"http-alt-81",
"imap",
"imaps",
"msrpc"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|