Détails IP 187.15.133.194

Synthèse exécutive

Profil de menace

Score de risque —

Première observation 18/07/2026 05:23 UTC

Dernière observation 18/07/2026 05:33 UTC

Événements (période) 318

MITRE ATT&CK principal —

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

port_scan_syn

Comparaison ASN / FAI

ASN 212238 · 187.15.133.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 318 événements sur la période pour cette IP.

154.16.95.12 Protocole TDS MSSQL 18/07/2026 19:39 UTC
89.187.168.40 Sonde Memcached 18/07/2026 18:48 UTC
82.21.59.200 couchdb probe 18/07/2026 14:05 UTC
147.90.209.18 Tentative d'exploit 18/07/2026 12:26 UTC
82.21.56.72 consul probe 18/07/2026 10:31 UTC
82.21.56.171 couchdb probe 17/07/2026 23:58 UTC
89.187.162.108 cpanel probe 17/07/2026 10:08 UTC
158.173.158.58 Sonde FTP 17/07/2026 08:57 UTC

IPs apparentées

Même FAI Datacamp Limited — corrélation indicative.

154.16.95.12 Protocole TDS MSSQL
89.187.168.40 Sonde Memcached
82.21.59.200 couchdb probe
147.90.209.18 Tentative d'exploit
82.21.56.72 consul probe

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 63 RPCBIND TCP 36 AFP TCP 31 PPTP TCP 31 X11 TCP 30 MSRPC TCP 30 TERADATA TCP 30 SMB TCP 30 Telnet TCP 7 FTP TCP 4 POP3S TCP 3 IMAPS TCP 3 RDP TCP 3 POP3 TCP 2 IMAP TCP 2 WEBLOGIC TCP 2 H323 TCP 2 HTTP ALT 81 TCP 1 VNC TCP 1 SMTP SUBMISSION TCP 1

HTTP

RPCBIND

AFP

PPTP

X11

MSRPC

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

318 événement(s) — page 1/7

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 05:33:07 UTC	TCP	7001 · WEBLOGIC	weblogic	weblogic probe weblogic probe · via WEBLOGIC:7001 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBLOGIC WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7001 Chemin / cible — Service WEBLOGIC Payload GIOP Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 77 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Weblogic Console Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GIOP Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "bytes_in": 5, "payload_entropy": 2.321928094887362, "port_category": "registered", "org": "Datacamp Limited", "service": "weblogic", "app_proto": "weblogic", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 33, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2", "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence": 0.85, "classification_confidence": 0.85, "precision_score": 87, "precision_signals": [ "INT-weblogic_console", "INT-upstream" ], "kb_rule_ids": [ "INT-weblogic_console", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "weblogic", "risk_confidence_factor": 77, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "87e8503fc1fa9337182ff6baaa9ea402", "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3" }, "target_context": { "dst_port": 7001, "service": "weblogic", "service_name": "weblogic", "risk_score": 33 }, "payload_preview": "GIOP\n", "request_sample": "GIOP\n", "payload_snippet": "GIOP", "evidence": { "request_sample": "GIOP\n", "payload_snippet": "GIOP", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b3f1bdb0cccc6fa76ea5e02ad8f08d1f24affb8", "protocol_details": { "payload_preview": "GIOP", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "evidence_snippet": "GIOP", "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "weblogic", "service_label_fr": "WEBLOGIC", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-weblogic_console", "INT-upstream" ], "tags_summary_labels_fr": [ "Weblogic Console", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GIOP", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "evidence_snippet": "GIOP", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic", "service_banner": "honeypot-weblogic", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 24, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_weblogic_probe", "weblogic_emulated" ] }
18/07/2026 05:33:06 UTC	TCP	7001 · WEBLOGIC	weblogic	weblogic probe weblogic probe · via WEBLOGIC:7001 · (sonde / probe)	—	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBLOGIC WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7001 Chemin / cible — Service WEBLOGIC Payload t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://localhost:7001\nLP:DOMAIN\n\n Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 77 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Weblogic Console Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://localhost:7001\nLP:DOMAIN\n\n Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "bytes_in": 76, "payload_entropy": 4.529464436404715, "port_category": "registered", "org": "Datacamp Limited", "service": "weblogic", "app_proto": "weblogic", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2", "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence": 0.85, "classification_confidence": 0.85, "precision_score": 87, "precision_signals": [ "INT-weblogic_console", "INT-upstream" ], "kb_rule_ids": [ "INT-weblogic_console", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "weblogic", "risk_confidence_factor": 77, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c24de847ea2758b7ab499e13cb3f9b3", "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3" }, "target_context": { "dst_port": 7001, "service": "weblogic", "service_name": "weblogic", "risk_score": 33 }, "payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "request_sample": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "payload_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "evidence": { "request_sample": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "payload_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f00ce6c0f65493bdb6e2540939c03fa7389037cf", "protocol_details": { "payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "evidence_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "weblogic", "service_label_fr": "WEBLOGIC", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-weblogic_console", "INT-upstream" ], "tags_summary_labels_fr": [ "Weblogic Console", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "evidence_snippet": "t3 12.2.1\\nAS:255\\nHL:19\\nMS:10000000\\nPU:t3:\/\/localhost:7001\\nLP:DOMAIN\\n\\n", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic", "service_banner": "honeypot-weblogic", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 24, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_weblogic_probe", "weblogic_emulated" ] }
18/07/2026 05:33:04 UTC	TCP	7001 · HTTP	http	Sonde port 7001/TCP port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /index.html	—	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /index.html UA curl/8.18.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags scanner-ua Cible HTTP GET /index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /index.html Preuve honeypot — Sonde port 7001/TCP Connexion détectée sur le port 7001 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55% Confiance classification 63% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /index.html HTTP/1.1` User-Agent curl/8.18.0 Règles WAF scanner-ua Payload (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.984215808671972, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 20, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 1, "campaign_key": "14268ee52afd0b5291bd0e48cbec364c9992b576", "event_fingerprint": "cac7c15593907d2143f9e6831fc7b561af7347ca", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.63, "classification_confidence": 0.63, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20, "risk_score": 38, "correlation_boost": 8 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "a2c56fd294d0d8d91e9756fda0c81cfb", "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/index.html", "user_agent": "curl\/8.18.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/index.html", "user_agent": "curl\/8.18.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f24a8f9ed277e2e9a5da51df326391ce5962cdd3", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/index.html", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 63, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20, "risk_score": 38, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/index.html", "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:33:03 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /etc/passwd	—	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /etc/passwd UA curl/8.18.0 Émulateur HTTP WAF 17 Recommandation Investiguer Tags 950264:lfi-1 950468:nosqli-3 scanner-ua Cible HTTP GET /etc/passwd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /etc/passwd Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 57 Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1083 pat-0716 pat-0802 pat-0137 Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 930160 etc passwd MITRE T1083 file enum LFI path /etc/passwd Ligne de requête `GET /etc/passwd HTTP/1.1` User-Agent curl/8.18.0 Règles WAF lfi-1 nosqli-3 scanner-ua Payload (extrait) GET /etc/passwd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.908788353366387, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 76, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 76, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 57, "tag_count": 7, "anomaly_count": 1, "campaign_key": "dc7e570db9c010dc90574d9011569e5ce6612cae", "event_fingerprint": "f344e6b627c949331b45f4c0866a55a5d25daa72", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 344, "precision_signals": [ "MITRE-T1083", "pat-0716", "pat-0802", "pat-0137", "CRS-930100-sub" ], "kb_rule_ids": [ "MITRE-T1083", "pat-0716", "pat-0802", "pat-0137", "CRS-930100-sub" ], "matched_patterns": [ "pat-0716", "pat-0802", "pat-0137" ], "matched_pattern_names": [ "CRS 930160 etc passwd", "MITRE T1083 file enum", "LFI path \/etc\/passwd" ], "pattern_ids": [ "pat-0716", "pat-0802", "pat-0137" ], "confidence_breakdown": { "waf": 76, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 57, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "b10ad0dcd870e572c798ddf16134b675", "path_pattern_hash": "74acf31844532670be412c65b8251ee5" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/etc\/passwd", "user_agent": "curl\/8.18.0", "waf_tags": [ "950264:lfi-1", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "lfi-1", "nosqli-3", "scanner-ua" ], "request_line": "GET \/etc\/passwd HTTP\/1.1", "request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/etc\/passwd", "user_agent": "curl\/8.18.0", "waf_tags": [ "950264:lfi-1", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "lfi-1", "nosqli-3", "scanner-ua" ], "request_line": "GET \/etc\/passwd HTTP\/1.1", "request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "32e3bf429b6bb85dce13ab1b390e8501831b088f", "protocol_details": { "http_method": "GET", "http_path": "\/etc\/passwd", "request_line": "GET \/etc\/passwd HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 76, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 57, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1083", "pat-0716", "pat-0802", "pat-0137" ], "tags_summary_labels_fr": [ "MITRE-T1083", "pat-0716", "pat-0802", "pat-0137" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/etc\/passwd", "request_line": "GET \/etc\/passwd HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd", "evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 76 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950264:lfi-1", "950468:nosqli-3", "anomaly:scanner-ua", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:33:01 UTC	TCP	7001 · HTTP	http	Sonde port 7001/TCP port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /xyzzy123nonexistent	—	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /xyzzy123nonexistent UA curl/8.18.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags scanner-ua Cible HTTP GET /xyzzy123nonexistent TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /xyzzy123nonexistent Preuve honeypot — Sonde port 7001/TCP Connexion détectée sur le port 7001 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55% Confiance classification 63% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /xyzzy123nonexistent HTTP/1.1` User-Agent curl/8.18.0 Règles WAF scanner-ua Payload (extrait) GET /xyzzy123nonexistent HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "8806a414d8e20a12dd95049c6e3e79c9ccea0894", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.987849840467882, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 20, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 1, "campaign_key": "14268ee52afd0b5291bd0e48cbec364c9992b576", "event_fingerprint": "51441ea8a70fcd266b252ce238850ce0abeda9fa", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.63, "classification_confidence": 0.63, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20, "risk_score": 38, "correlation_boost": 8 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "be5405461ffcb810f2e4f29fc7b10c23", "path_pattern_hash": "9065f39222d0eef25e94df9a5410440f" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/xyzzy123nonexistent", "user_agent": "curl\/8.18.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/xyzzy123nonexistent HTTP\/1.1", "request_sample": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/xyzzy123nonexistent", "user_agent": "curl\/8.18.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/xyzzy123nonexistent HTTP\/1.1", "request_sample": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f48bad24e156d0fccab1107cd0778daccd0d9e7b", "protocol_details": { "http_method": "GET", "http_path": "\/xyzzy123nonexistent", "request_line": "GET \/xyzzy123nonexistent HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/xyzzy123nonexistent", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 63, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 20, "risk_score": 38, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/xyzzy123nonexistent", "request_line": "GET \/xyzzy123nonexistent HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/xyzzy123nonexistent", "evidence_snippet": "GET \/xyzzy123nonexistent HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:33:00 UTC	TCP	7001 · HTTP	http	Sonde port 7001/TCP port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /ws_utc/begin.do	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /ws_utc/begin.do UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /ws_utc/begin.do TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /ws_utc/begin.do Preuve honeypot — Sonde port 7001/TCP Connexion détectée sur le port 7001 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55% Confiance classification 63% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ws_utc/begin.do HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /ws_utc/begin.do HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "do", "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "7ed3cdd8446f34870607542f360362a65fec7572", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 94, "payload_entropy": 4.997623863819755, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 40, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "b8aba1e86d022a3610704402f922686cdd3b018f", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.63, "classification_confidence": 0.63, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 40, "correlation_boost": 8 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "7c3b4e862759d44b3d152bc6199bf2b5", "path_pattern_hash": "379831a3339bbfacffb13ab7c9588e0d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/ws_utc\/begin.do", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/ws_utc\/begin.do HTTP\/1.1", "request_sample": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/ws_utc\/begin.do", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/ws_utc\/begin.do HTTP\/1.1", "request_sample": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c593c255f5660b3a6ef9ccaea83f2664550a73e9", "protocol_details": { "http_method": "GET", "http_path": "\/ws_utc\/begin.do", "request_line": "GET \/ws_utc\/begin.do HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ws_utc\/begin.do", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 63, "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws_utc\/begin.do", "request_line": "GET \/ws_utc\/begin.do HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ws_utc\/begin.do", "evidence_snippet": "GET \/ws_utc\/begin.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ], "behavior_alert_count": 2, "behavior_priority": 72 }
18/07/2026 05:32:58 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /bea_wls_internal/	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /bea_wls_internal/ UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /bea_wls_internal/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /bea_wls_internal/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET /bea_wls_internal/ HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /bea_wls_internal/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "6d299ba7710f14e2f9805c600e6fa48f4e3660e8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 96, "payload_entropy": 5.013689689349748, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "aa30c89c7f87ba0daaa0b64c4c55c6fd479d3285", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "b841073e3c3caa12ed3e56a1bf39cb8b", "path_pattern_hash": "717f23bb07baf9c07a18b2acf638d391" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/bea_wls_internal\/", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/bea_wls_internal\/ HTTP\/1.1", "request_sample": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/bea_wls_internal\/", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/bea_wls_internal\/ HTTP\/1.1", "request_sample": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3c7bdbe6b826f5f8d3ca64d0840dd6bced27985", "protocol_details": { "http_method": "GET", "http_path": "\/bea_wls_internal\/", "request_line": "GET \/bea_wls_internal\/ HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/bea_wls_internal\/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/bea_wls_internal\/", "request_line": "GET \/bea_wls_internal\/ HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/bea_wls_internal\/", "evidence_snippet": "GET \/bea_wls_internal\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 81, 199, 548, 1720, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:56 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /_async/AsyncResponseService	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /_async/AsyncResponseService UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /_async/AsyncResponseService TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /_async/AsyncResponseService Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) CVE-2019-2725 WebLogic CVE-2019-2725 Ligne de requête `GET /_async/AsyncResponseService HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.02609206894104, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "b2624b0e4471fbbf800f6475da10222096755cc4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0179" ], "matched_pattern_names": [ "CVE-2019-2725 WebLogic CVE-2019-2725" ], "pattern_ids": [ "pat-0179" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "f46c83e962920586c0f27a7fc3db2558", "path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb765f4bafba41d20cfc6705facde5db73ecc7ca", "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService", "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:55 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /wls-wsat/CoordinatorPortType	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /wls-wsat/CoordinatorPortType UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /wls-wsat/CoordinatorPortType TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /wls-wsat/CoordinatorPortType Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) WebLogic wls-wsat Ligne de requête `GET /wls-wsat/CoordinatorPortType HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 107, "payload_entropy": 5.057474763414213, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 6, "anomaly_count": 1, "campaign_key": "9a13839e361d7a021b1792ac4f054c4cd3837a93", "event_fingerprint": "af8fe99e3af1262506b6c57904f48eff4e2bbd3c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0602" ], "matched_pattern_names": [ "WebLogic wls-wsat" ], "pattern_ids": [ "pat-0602" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "888a0551366fdb0e2c778f40b89466b9", "path_pattern_hash": "16111671401e187b64b702a8ecb56bdf" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38b506daea38c8c8cc5e3f2a3b9ec1ba9d7e25c6", "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_weblogic_wls", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:53 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /console/login/LoginForm.jsp	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /console/login/LoginForm.jsp UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /console/login/LoginForm.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /console/login/LoginForm.jsp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) ET WebLogic console WebLogic console path WebLogic cluster Probe /console/ Ligne de requête `GET /console/login/LoginForm.jsp HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /console/login/LoginForm.jsp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "jsp", "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.010663087588212, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 7, "anomaly_count": 1, "campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc", "event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "matched_pattern_names": [ "ET WebLogic console", "WebLogic console path", "WebLogic cluster", "Probe \/console\/" ], "pattern_ids": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "35dc329ce3f6aab88c2a34aa8b61dbcc", "path_pattern_hash": "787be5555f9e6e61f95410bb9176809f" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a249b8ed14ccb256413b17575441962a63d85092", "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ], "behavior_alert_count": 1, "behavior_priority": 84 }
18/07/2026 05:32:52 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / UA curl/8.18.0 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent curl/8.18.0 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 79, "payload_entropy": 4.808677786930841, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 1, "campaign_key": "76a34fae6cdf27dbce726d0e01d7bb35bd87f3e8", "event_fingerprint": "376abaf7e39dc177b1f8bb2aae32add1c2ac03cc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "b393ba726e0e8ede8aeb3584978e4511", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/", "user_agent": "curl\/8.18.0", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "curl\/8.18.0", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76b3b090baa789989050428a498b948633c9c222", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:26 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /_async/AsyncResponseService	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /_async/AsyncResponseService UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /_async/AsyncResponseService TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /_async/AsyncResponseService Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) CVE-2019-2725 WebLogic CVE-2019-2725 Ligne de requête `GET /_async/AsyncResponseService HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.02609206894104, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "b2624b0e4471fbbf800f6475da10222096755cc4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0179" ], "matched_pattern_names": [ "CVE-2019-2725 WebLogic CVE-2019-2725" ], "pattern_ids": [ "pat-0179" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "f46c83e962920586c0f27a7fc3db2558", "path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb765f4bafba41d20cfc6705facde5db73ecc7ca", "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/_async\/AsyncResponseService", "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:25 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /wls-wsat/CoordinatorPortType	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /wls-wsat/CoordinatorPortType UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /wls-wsat/CoordinatorPortType TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /wls-wsat/CoordinatorPortType Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) WebLogic wls-wsat Ligne de requête `GET /wls-wsat/CoordinatorPortType HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 107, "payload_entropy": 5.057474763414213, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 6, "anomaly_count": 1, "campaign_key": "9a13839e361d7a021b1792ac4f054c4cd3837a93", "event_fingerprint": "af8fe99e3af1262506b6c57904f48eff4e2bbd3c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0602" ], "matched_pattern_names": [ "WebLogic wls-wsat" ], "pattern_ids": [ "pat-0602" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "888a0551366fdb0e2c778f40b89466b9", "path_pattern_hash": "16111671401e187b64b702a8ecb56bdf" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38b506daea38c8c8cc5e3f2a3b9ec1ba9d7e25c6", "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_weblogic_wls", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:32:24 UTC	TCP	7001 · HTTP	http	Scan de ports port scan syn · via HTTP:7001 · (reconnaissance) · → /console/login/LoginForm.jsp	—	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /console/login/LoginForm.jsp UA curl/8.18.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua Cible HTTP GET /console/login/LoginForm.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /console/login/LoginForm.jsp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) ET WebLogic console WebLogic console path WebLogic cluster Probe /console/ Ligne de requête `GET /console/login/LoginForm.jsp HTTP/1.1` User-Agent curl/8.18.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /console/login/LoginForm.jsp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "jsp", "http_ua_hash": "4a8e5f52654f8f3be11e8c18e174fffc7fcda19e", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.010663087588212, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 7001, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 43, "tag_count": 7, "anomaly_count": 1, "campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc", "event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "matched_pattern_names": [ "ET WebLogic console", "WebLogic console path", "WebLogic cluster", "Probe \/console\/" ], "pattern_ids": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "87da89131acc05cb861c80340d3d7610", "payload_hash": "35dc329ce3f6aab88c2a34aa8b61dbcc", "path_pattern_hash": "787be5555f9e6e61f95410bb9176809f" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "curl\/8.18.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a249b8ed14ccb256413b17575441962a63d85092", "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 43, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "curl\/8.18.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 111, 135, 199, 445, 548, 1025, 1720, 1723, 6001, 7001, 8080, 8888 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ], "behavior_alert_count": 1, "behavior_priority": 84 }
18/07/2026 05:31:59 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 67, "payload_entropy": 4.654964750995319, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8080, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1952973b298753bacd8311ca7b61685d03229984", "event_fingerprint": "1a73e52fcb0af206bdd873fdc276f059b19b837a", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "84de652504b56efe8de0bfc43206a7087f4f121c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.44, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:59 UTC	TCP	81 · HTTP	http	Scan de ports port scan syn · via HTTP:81 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 67, "payload_entropy": 4.654964750995319, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 81, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c19c2f4ff3fb5468d74dc878620d95d99e047516", "event_fingerprint": "71966f4e7329013dca27ba512562d6a0d100c0ea", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46b6c21bb6aee72c13bc42816e7f90e0cf302d87", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.43, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:59 UTC	TCP	199 · HTTP	http	Scan de ports port scan syn · via HTTP:199 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 199 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 67, "payload_entropy": 4.654964750995319, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 199, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c781537e1814856434ff01b22fc1bf0d1bfdd354", "event_fingerprint": "9521c9a82939c8d82a6e4de472d0fd6bf9c73e00", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 199, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20e6426ae637e7c591c90879da91347736fdb32b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 199, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "199" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.41, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:59 UTC	TCP	1720 · HTTP	http	Scan de ports port scan syn · via HTTP:1720 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1720 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 67, "payload_entropy": 4.654964750995319, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 1720, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3508f737fa4edc0eec52a0cfb4a57e74dd00d0de", "event_fingerprint": "ea58eea66a22312e866acfe278d640d1f8aac7f7", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1720, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83b076089514a0046d7cf20908a486188cf009df", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1720, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1720" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.41, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:59 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "5274ee84a9e8dfce0649a29ab6b87e779a782ba8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 67, "payload_entropy": 4.654964750995319, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8888, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "05c58c5f19ad288de9a49d67ac759a6d356e63bd", "event_fingerprint": "80f2aa9a52b555c26e5706a111edbf5b4c7d378f", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c81ef5d77cdb942048fd9a9bbc6e7f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "345b9906e5780ebe962dc35e5942256a3e5435ac", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.4, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:58 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �(R��35 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(R��35 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 2.0057587693095926, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05", "event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ef119654acaa9ddd31bb6b11d557d787", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2156d45a0666edd6fb36d667eb6175f5c54b36b7", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(R\ufffd\ufffd\ufffd\ufffd35", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0003R\ufffd\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0001\ufffd35\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(R\ufffd\ufffd\ufffd\ufffd35", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.61, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
18/07/2026 05:31:58 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �(Z��N� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(Z��N� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 2.1138243943587627, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05", "event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "249ed8eee1c2bca431337b23f0da8bfd", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "15e4e1254e0a33f372d2e63a24f0933b6ff039cd", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(Z\ufffd\ufffd\ufffd\ufffdN\ufffd", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0006Z\ufffd\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0004\ufffdN\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(Z\ufffd\ufffd\ufffd\ufffdN\ufffd", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.61, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
18/07/2026 05:31:58 UTC	TCP	1025 · TERADATA	teradata	Scan de ports port scan syn · via TERADATA:1025 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur TERADATA WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1025 Chemin / cible — Service TERADATA Payload �(F�2�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(F�2�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000000c0000000000000000", "emulator_response_len": 12, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "registered", "org": "Datacamp Limited", "service": "teradata", "app_proto": "teradata", "asn": 212238, "country": "JP", "dst_port": 1025, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ce63e0435125cbad53c3ad478c4501690cfa39b6", "event_fingerprint": "a85579a7a3e45f06afb902a019cc7327fde3a2f5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "teradata", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ccb74f2b059a88995e2c13f370275514", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1025, "service": "teradata", "service_name": "teradata", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1127b4cfd5b233b814de9108208e6f515e42b6dd", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "evidence_snippet": "\ufffd(F\ufffd2\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via TERADATA:1025 \u00b7 (reconnaissance)", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TERADATA \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "teradata", "service_label_fr": "TERADATA", "dst_port": 1025, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-teradata", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(F\ufffd2\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "attack_vector": "port scan syn \u00b7 via TERADATA:1025 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(F\ufffd2\ufffd\ufffd\ufffd", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "teradata", "service_banner": "honeypot-teradata", "service_os": "linux", "dst_port": "1025" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 1.81, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_teradata_probe", "teradata_emulated", "teradata_payload" ] }
18/07/2026 05:31:58 UTC	TCP	445 · SMB	smb	Scan de ports port scan syn · via SMB:445 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SMB WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 445 Chemin / cible — Service SMB Payload �(:�@�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(:�@�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000048", "emulator_response_len": 4, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "well_known", "org": "Datacamp Limited", "service": "smb", "app_proto": "smb", "asn": 212238, "country": "JP", "dst_port": 445, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4560951323ba5b3a6a7907c70c916357c8828769", "event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "smb", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c6d8648da51e54bedd26a884173e55eb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 445, "service": "smb", "service_name": "smb", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "af1c062d0c0a5ded6ceac4080002ec9731e3af4e", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "evidence_snippet": "\ufffd(:\ufffd@\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via SMB:445 \u00b7 (reconnaissance)", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SMB \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "smb", "service_label_fr": "SMB", "dst_port": 445, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-smb", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(:\u0016\ufffd@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "attack_vector": "port scan syn \u00b7 via SMB:445 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(:\ufffd@\ufffd\ufffd", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "smb", "service_banner": "honeypot-smb", "service_os": "linux", "dst_port": "445" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 10, "scan_velocity_ports_per_s": 2.01, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_bruteforce", "net_smb_probe", "smb_emulated" ] }
18/07/2026 05:31:58 UTC	TCP	6001 · X11	x11	Scan de ports port scan syn · via X11:6001 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur X11 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6001 Chemin / cible — Service X11 Payload �( J\�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �( J\�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742078313120726561647920706f72743d363030310d0a", "emulator_response_len": 34, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "registered", "org": "Datacamp Limited", "service": "x11", "app_proto": "x11", "asn": 212238, "country": "JP", "dst_port": 6001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4a57156e8ef1463662de16921041f4d7cce03333", "event_fingerprint": "68d1dd076fb0197faf30ecf6b04beb0759fee0bb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "x11", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f3836379654812e48b25d82c62ad3f2f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6001, "service": "x11", "service_name": "x11", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a8b17a098ebd49baedb9fb850e9ada3f748f39f", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 6001, "service": "x11", "service_label_fr": "X11" }, "evidence_snippet": "\ufffd( J\\\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)", "target_port_label": "6001 \u00b7 X11", "emulator_service": "x11", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "x11", "service_label_fr": "X11", "dst_port": 6001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000( J\\\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 6001, "service": "x11", "service_label_fr": "X11" }, "attack_vector": "port scan syn \u00b7 via X11:6001 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd( J\\\ufffd\ufffd\ufffd", "target_port_label": "6001 \u00b7 X11", "emulator_service": "x11", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11", "service_banner": "honeypot-x11", "service_os": "linux", "dst_port": "6001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 11, "scan_velocity_ports_per_s": 2.21, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
18/07/2026 05:31:58 UTC	TCP	135 · MSRPC	msrpc	Scan de ports port scan syn · via MSRPC:135 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MSRPC WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 135 Chemin / cible — Service MSRPC Payload �(z�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206d7372706320726561647920706f72743d3133350d0a", "emulator_response_len": 35, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "well_known", "org": "Datacamp Limited", "service": "msrpc", "app_proto": "msrpc", "asn": 212238, "country": "JP", "dst_port": 135, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e8150bd3a3273a7f243736803d5c3834f10913be", "event_fingerprint": "7121eff0ac90f78b66b61eb5b339241632ad42e0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "msrpc", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "660b573881194d2d021d9e8d5470ace7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 135, "service": "msrpc", "service_name": "msrpc", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d9ac31912c3ab0e0322ffb339e54419b2952d04", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 135, "service": "msrpc", "service_label_fr": "MSRPC" }, "evidence_snippet": "\ufffd(z\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via MSRPC:135 \u00b7 (reconnaissance)", "target_port_label": "135 \u00b7 MSRPC", "emulator_service": "msrpc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MSRPC \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "msrpc", "service_label_fr": "MSRPC", "dst_port": 135, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-msrpc", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0014z\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 135, "service": "msrpc", "service_label_fr": "MSRPC" }, "attack_vector": "port scan syn \u00b7 via MSRPC:135 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(z\ufffd\ufffd\ufffd", "target_port_label": "135 \u00b7 MSRPC", "emulator_service": "msrpc", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "msrpc", "service_banner": "honeypot-msrpc", "service_os": "linux", "dst_port": "135" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.41, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_port_scan_fast" ] }
18/07/2026 05:31:58 UTC	TCP	1723 · PPTP	pptp	Scan de ports port scan syn · via PPTP:1723 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur PPTP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1723 Chemin / cible — Service PPTP Payload �(3tB�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(3tB�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "009a000100000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "emulator_response_len": 152, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "registered", "org": "Datacamp Limited", "service": "pptp", "app_proto": "pptp", "asn": 212238, "country": "JP", "dst_port": 1723, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8632c0f3a4befa9502f68e1a5ec91935f80f98d1", "event_fingerprint": "904dec90409cdde746c8f5ac626df5ddf2796f9b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "pptp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "163c6bf475bf2b383a08f33afee9360e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1723, "service": "pptp", "service_name": "pptp", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4020c42322c0c71abe88696e11bfb9c671917e2c", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1723, "service": "pptp", "service_label_fr": "PPTP" }, "evidence_snippet": "\ufffd(3tB\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)", "target_port_label": "1723 \u00b7 PPTP", "emulator_service": "pptp", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PPTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "pptp", "service_label_fr": "PPTP", "dst_port": 1723, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-pptp", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(3tB\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1723, "service": "pptp", "service_label_fr": "PPTP" }, "attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(3tB\ufffd\ufffd\ufffd", "target_port_label": "1723 \u00b7 PPTP", "emulator_service": "pptp", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "pptp", "service_banner": "honeypot-pptp", "service_os": "linux", "dst_port": "1723" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.41, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_port_scan_fast", "pptp_emulated", "pptp_payload" ] }
18/07/2026 05:31:58 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8888, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "05c58c5f19ad288de9a49d67ac759a6d356e63bd", "event_fingerprint": "80f2aa9a52b555c26e5706a111edbf5b4c7d378f", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c678bbbbb221fad8612434ce5af0a6ae1198d551", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.4, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
18/07/2026 05:31:58 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �(p�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(p�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 2.1138243943587627, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c3e25cab9917244e5288b3322c2bce33c9505d78", "event_fingerprint": "7890ff4d1c4cb9540f6f6ccebb3623a9e91cbbbd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0ecb4a8d12632075758d4eac427055e6", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "abbedd2698ec7d9342c150512a762743c17076f6", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(p\ufffd\ufffd\ufffd\ufffd\n\ufffd", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0003p\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0007\n\u001a\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(p\ufffd\ufffd\ufffd\ufffd\n\ufffd", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.4, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_port_scan_fast" ] }
18/07/2026 05:31:58 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �(�=��.hG Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(�=��.hG Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 2.0683698489042173, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c3e25cab9917244e5288b3322c2bce33c9505d78", "event_fingerprint": "7890ff4d1c4cb9540f6f6ccebb3623a9e91cbbbd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ed546dbdfa464899c307676ad848a5fc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d8f65ade21ac3e291463bdcf107a8f353a43b004", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(\ufffd=\ufffd\ufffd\ufffd.hG", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0006\ufffd=\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0005.hG\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(\ufffd=\ufffd\ufffd\ufffd.hG", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.4, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_port_scan_fast" ] }
18/07/2026 05:31:58 UTC	TCP	548 · AFP	afp	Scan de ports port scan syn · via AFP:548 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur AFP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 548 Chemin / cible — Service AFP Payload �([d�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �([d�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "01040000000000000000000041465056657273696f6e20332e330d10000612000000", "emulator_response_len": 34, "bytes_in": 44, "payload_entropy": 1.630681483663912, "port_category": "well_known", "org": "Datacamp Limited", "service": "afp", "app_proto": "afp", "asn": 212238, "country": "JP", "dst_port": 548, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "66f5e9ebe6f0ac7ef886fec425432536b06ae217", "event_fingerprint": "48f198e90269326e36107de80ad6deccecbf7a78", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "afp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "64f7162c8cbe9eef55a1c1bdcd1d61ad", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 548, "service": "afp", "service_name": "afp", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "52272e75d6bbe418e95454979b36dc17aea0bc35", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 548, "service": "afp", "service_label_fr": "AFP" }, "evidence_snippet": "\ufffd([d\ufffd\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)", "target_port_label": "548 \u00b7 AFP", "emulator_service": "afp", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AFP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "afp", "service_label_fr": "AFP", "dst_port": 548, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-afp", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\u0007[d\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 548, "service": "afp", "service_label_fr": "AFP" }, "attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd([d\ufffd\ufffd\ufffd", "target_port_label": "548 \u00b7 AFP", "emulator_service": "afp", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "afp", "service_banner": "honeypot-afp", "service_os": "linux", "dst_port": "548" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 2.51, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "afp_emulated", "afp_payload", "mongodb_probe", "net_port_scan_fast" ] }
18/07/2026 05:31:56 UTC	TCP	8080 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:8080 · (sonde / probe) · → /Nmap/folder/check1784352718	—	Moyen · 60
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /Nmap/folder/check1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible /Nmap/folder/check1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /Nmap/folder/check1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Requête brute (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "52f07e08fde357a7f4b6e144985f039d8b76dc77", "http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.241091275368707, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8080, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 60, "tag_count": 8, "anomaly_count": 1, "campaign_key": "244aeb3457260b8becfb01c5a8288c41144d3bc9", "event_fingerprint": "90348e19e9284dd437cb833a630f7cfc6cc9e834", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "b4729141c1331044bd8879e137fbedfd", "path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: ", "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:", "evidence": { "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94443ef900bd50b533c925b73de2c2f32eed1738", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:", "attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent:", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.88, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ], "behavior_alert_count": 1, "behavior_priority": 84 }
18/07/2026 05:31:56 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �( �?V�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �( �?V�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 1.7776134368191159, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05", "event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c40fae1fcc2f70ead1e5987a6041a416", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "26d72ab9f2926cdf1aaef1f002bb504277e1a179", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(\t\ufffd?V\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(\t\ufffd?V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(\t\ufffd?V\ufffd\ufffd", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.88, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
18/07/2026 05:31:55 UTC	TCP	8888 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:8888 · (sonde / probe) · → /NmapUpperCheck1784352718	—	Moyen · 59
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /NmapUpperCheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible /NmapUpperCheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA HTTP alt 8888 probe Ligne de requête `GET /NmapUpperCheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Moz Requête brute (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1", "http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 208, "payload_entropy": 5.215808511235892, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8888, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 1, "campaign_key": "b3282692df2834ba30fc5caa3c2533845a71cd48", "event_fingerprint": "e48fcbe01853fa5d3bef1234a96c2b5c7e93c793", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "fe9d84c16810991e0ed6ea8fb4180f37", "path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz", "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz", "evidence": { "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8b7c909c0dcfb8047a8ad5c09fdda91bd480e2e", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz", "attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Moz", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.75, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	81 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:81 · (sonde / probe) · → /NmapUpperCheck1784352718	—	Moyen · 59
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /NmapUpperCheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible /NmapUpperCheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /NmapUpperCheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozil Requête brute (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f", "http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 206, "payload_entropy": 5.21243235238441, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 81, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 1, "campaign_key": "67fe9b83623439dff030f5db0a8dd1729a7738c9", "event_fingerprint": "ea776d0418c2c5be6e4adbc432096c2d57b653fc", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "7a146d5a43a32269aacf925feafbdaea", "path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "evidence": { "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d23ecff62d0c82a107fe460d5bf9e52e514bdaf", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.73, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	1720 · HTTP	http	Scan de ports port scan syn · via HTTP:1720 · (reconnaissance) · → /evox/about	—	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1720 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Probe /evox/about UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (comp Requête brute (extrait) GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf", "http_target_hash": "9e931bb53b054c2fff95daa013fecdd4ca2a01a2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 194, "payload_entropy": 5.156657139436861, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 1720, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 60, "tag_count": 7, "anomaly_count": 1, "campaign_key": "ff42e7281b45d1d95158b7b06938f3ea5e80a7ce", "event_fingerprint": "352bb29008b308eb655ec72e181819d9b7639942", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0255", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "LFI Double-dot bypass", "Probe \/evox\/about", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0103", "pat-0255", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "120f4f2570a7a162d7023c0bbf1414ba", "path_pattern_hash": "6c06e7a5a57aea56adce71b0743fb577" }, "target_context": { "dst_port": 1720, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp", "method": "GET", "path": "\/evox\/about", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/evox\/about HTTP\/1.1", "request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp", "evidence": { "method": "GET", "path": "\/evox\/about", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/evox\/about HTTP\/1.1", "request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "120b1f470d2be3727bcbe8ba64613aa100c315ad", "protocol_details": { "http_method": "GET", "http_path": "\/evox\/about", "request_line": "GET \/evox\/about HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp", "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1720, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/evox\/about", "request_line": "GET \/evox\/about HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about", "evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (comp", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1720" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.72, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	1720 · HTTP	http	Scan de ports port scan syn · via HTTP:1720 · (reconnaissance) · → /HNAP1	—	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /HNAP1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1720 Chemin / cible /HNAP1 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /HNAP1 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatibl Requête brute (extrait) GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf", "http_target_hash": "92c22322858be108c9b5ebcfd6f2c3cb5ceee211", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 189, "payload_entropy": 5.165823708932025, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 1720, "risk_waf": 96, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 1, "campaign_key": "a5697c8efd47cb0d8f75f9e56bafac486c24bbb1", "event_fingerprint": "7dafdbdf1babff5c47a316c50d537b526037b3f2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "a7760b7b0d7ff2e11b5594ea442d5d26", "path_pattern_hash": "6fce0d6d2998b47f09e54396e5a34d07" }, "target_context": { "dst_port": 1720, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl", "method": "GET", "path": "\/HNAP1", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/HNAP1 HTTP\/1.1", "request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl", "evidence": { "method": "GET", "path": "\/HNAP1", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/HNAP1 HTTP\/1.1", "request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fec71780b5657eb5071ad97de8a75de2dc981c78", "protocol_details": { "http_method": "GET", "http_path": "\/HNAP1", "request_line": "GET \/HNAP1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl", "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1720, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/HNAP1", "request_line": "GET \/HNAP1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1", "evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatibl", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1720" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.72, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "iot_http_endpoint", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	199 · HTTP	http	Scan de ports port scan syn · via HTTP:199 · (reconnaissance) · → /HNAP1	—	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /HNAP1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 199 Chemin / cible /HNAP1 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /HNAP1 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible Requête brute (extrait) GET /HNAP1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8", "http_target_hash": "92c22322858be108c9b5ebcfd6f2c3cb5ceee211", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 188, "payload_entropy": 5.160076885254946, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 199, "risk_waf": 96, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 58, "tag_count": 7, "anomaly_count": 1, "campaign_key": "88cb7d75b6f30b4d9e48344e68d4546132e148f2", "event_fingerprint": "5ad7ca389dffebc96b301c303c47ae707431bcc1", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 58, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "00a9de5a0b64c157d3b97549ff50e07a", "path_pattern_hash": "6fce0d6d2998b47f09e54396e5a34d07" }, "target_context": { "dst_port": 199, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible", "method": "GET", "path": "\/HNAP1", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/HNAP1 HTTP\/1.1", "request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible", "evidence": { "method": "GET", "path": "\/HNAP1", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/HNAP1 HTTP\/1.1", "request_sample": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "717ab86f9327dc51d6f9af3a2eae0a2771b548d5", "protocol_details": { "http_method": "GET", "http_path": "\/HNAP1", "request_line": "GET \/HNAP1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible", "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 58, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 199, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/HNAP1", "request_line": "GET \/HNAP1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/HNAP1", "evidence_snippet": "GET \/HNAP1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "199" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.71, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "iot_http_endpoint", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	199 · HTTP	http	Scan de ports port scan syn · via HTTP:199 · (reconnaissance) · → /evox/about	—	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 199 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Probe /evox/about UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compa Requête brute (extrait) GET /evox/about HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8", "http_target_hash": "9e931bb53b054c2fff95daa013fecdd4ca2a01a2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 193, "payload_entropy": 5.150816007053635, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 199, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 60, "tag_count": 7, "anomaly_count": 1, "campaign_key": "64e4450163e4462a9a22fb4ba44ffe3ec0303e50", "event_fingerprint": "609ab42f55a36fa9e9203da8c948d730286aebdc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0255", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "LFI Double-dot bypass", "Probe \/evox\/about", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0103", "pat-0255", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "66eecce44162ed095e3acf941ba682be", "path_pattern_hash": "6c06e7a5a57aea56adce71b0743fb577" }, "target_context": { "dst_port": 199, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa", "method": "GET", "path": "\/evox\/about", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/evox\/about HTTP\/1.1", "request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa", "evidence": { "method": "GET", "path": "\/evox\/about", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/evox\/about HTTP\/1.1", "request_sample": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcf1a3c2e6b149dd42838a2242ce6c9d7944fdc4", "protocol_details": { "http_method": "GET", "http_path": "\/evox\/about", "request_line": "GET \/evox\/about HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa", "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 199, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/evox\/about", "request_line": "GET \/evox\/about HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance) \u00b7 \u2192 \/evox\/about", "evidence_snippet": "GET \/evox\/about HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compa", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "199" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.71, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	8080 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:8080 · (sonde / probe) · → /NmapUpperCheck1784352718	—	Moyen · 59
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /NmapUpperCheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /NmapUpperCheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible /NmapUpperCheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /NmapUpperCheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Moz Requête brute (extrait) GET /NmapUpperCheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8080 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "52f07e08fde357a7f4b6e144985f039d8b76dc77", "http_target_hash": "ea3c8605bd38eed70d8cede1c291d7fee6631625", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 208, "payload_entropy": 5.2230670449105405, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8080, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 1, "campaign_key": "973d8923003acbae0aa82479b53e1238c798b4d6", "event_fingerprint": "96db8e09f07c507dd15fb13d8bb8176668528581", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "626492d62151159b7cd1f36fda022065", "path_pattern_hash": "9cf048dcd0db3404a14c8d7099241dee" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz", "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz", "evidence": { "method": "GET", "path": "\/NmapUpperCheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "request_sample": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c98efbb9319b578eaa941906c9b27916295acd2c", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz", "attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/NmapUpperCheck1784352718", "request_line": "GET \/NmapUpperCheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/NmapUpperCheck1784352718", "evidence_snippet": "GET \/NmapUpperCheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8080\r\nConnection: close\r\nUser-Agent: Moz", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.7, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload �(B�r�� Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(B�r�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a", "emulator_response_len": 37, "bytes_in": 44, "payload_entropy": 1.8230679822736615, "port_category": "well_known", "org": "Datacamp Limited", "service": "rpcbind", "app_proto": "rpcbind", "asn": 212238, "country": "JP", "dst_port": 111, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c50df51aaaad5615ff8caf0e3d21c01c0efe7c05", "event_fingerprint": "cc6a30f113f8d9e6ef56552018adfd04a41a77dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "rpcbind", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bb44d60c223c3809f4b7cb40cfa7484e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 111, "service": "rpcbind", "service_name": "rpcbind", "risk_score": 42 }, "payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b2adfd97bf4f11261b8b01a15d4628e222e4dc7", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "evidence_snippet": "\ufffd(B\ufffdr\ufffd\ufffd", "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RPCBIND \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "rpcbind", "service_label_fr": "RPCBIND", "dst_port": 111, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rpcbind", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(B\u0011\ufffdr\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 111, "service": "rpcbind", "service_label_fr": "RPCBIND" }, "attack_vector": "port scan syn \u00b7 via RPCBIND:111 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd(B\ufffdr\ufffd\ufffd", "target_port_label": "111 \u00b7 RPCBIND", "emulator_service": "rpcbind", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rpcbind", "service_banner": "honeypot-rpcbind", "service_os": "linux", "dst_port": "111" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.69, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_mongodb_probe" ] }
18/07/2026 05:31:55 UTC	TCP	8888 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:8888 · (sonde / probe) · → /Nmap/folder/check1784352718	—	Moyen · 61
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /Nmap/folder/check1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible /Nmap/folder/check1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 61 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA HTTP alt 8888 probe Ligne de requête `GET /Nmap/folder/check1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Requête brute (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1", "http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.233935943594646, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8888, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 61, "tag_count": 8, "anomaly_count": 1, "campaign_key": "bde0b4fdbbb586954811f2b26316f35176a7bda0", "event_fingerprint": "f04ee0098cf2636a0cbdcc4be6fa5815c3432ba4", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 61, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "e2b46acfa36b9eadee6c3807a14d203b", "path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: ", "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:", "evidence": { "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d31d43a8c2e36b58755a57d8053fb90b9344fdba", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:", "attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 61, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nConnection: close\r\nUser-Agent:", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.97, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:55 UTC	TCP	81 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:81 · (sonde / probe) · → /Nmap/folder/check1784352718	—	Moyen · 60
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /Nmap/folder/check1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /Nmap/folder/check1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible /Nmap/folder/check1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /Nmap/folder/check1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mo Requête brute (extrait) GET /Nmap/folder/check1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f", "http_target_hash": "29aae09e6dcc04f134397e6ce1a6be68c49f9a76", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 209, "payload_entropy": 5.230583066573612, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 81, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 60, "tag_count": 8, "anomaly_count": 1, "campaign_key": "d63ab01dcc4f08dc61467dd9216c950adb0fcc51", "event_fingerprint": "d2eea910060b0152a36f871de6fc79ed65badd72", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "cd95758931d35ddac90eefe3e3b2f93e", "path_pattern_hash": "d74ddfe4742de5ed194784edfb96af60" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo", "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo", "evidence": { "method": "GET", "path": "\/Nmap\/folder\/check1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "request_sample": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c517b4155bdbccbf391e2344036d008f013122a9", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo", "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 60, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/Nmap\/folder\/check1784352718", "request_line": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/Nmap\/folder\/check1784352718", "evidence_snippet": "GET \/Nmap\/folder\/check1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mo", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 1.94, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:54 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → /sdk	—	Élevé · 77
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 TA0001 Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8888 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Élevé · 77 Confiance : Confiance 100 % — 8 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 TA0001 Motifs de détection (base) CRS 921130 duplicate CL CRS 941130 LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA HTTP alt 8888 probe Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Content-Length: 441 Connection: close User-Agent: Mo Requête brute (extrait) POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8888 Content-Length: 441 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) <soap:Envelope xmlns:xsd="http://www.w3.org/200 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "df8342def44035bb0811f534eb102e9eef5615e1", "http_target_hash": "5e2a035222ca1432dd7a4c0062da7711ee276c61", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 650, "payload_entropy": 5.282456176509406, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 8888, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 15, "risk_granularity": 6.5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 77, "tag_count": 13, "anomaly_count": 1, "campaign_key": "a9edf7102c063c042b9a56b8ce12af2e8832e766", "event_fingerprint": "044c5d88fb789cabb4309883d24717947aefc841", "classification_reason": "Motif SSRF \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0842", "pat-0284", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 941130", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0842", "pat-0284", "pat-0103", "pat-0425", "pat-0448", "pat-0543", "pat-0599" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 77, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "0c84863091b62cdb1dba23d38ffd4696", "path_pattern_hash": "b91a94364e548eac8280a672094b6c64" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 77 }, "payload_preview": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo", "method": "POST", "path": "\/sdk", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "POST \/sdk HTTP\/1.1", "request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/200", "payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo", "evidence": { "method": "POST", "path": "\/sdk", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "POST \/sdk HTTP\/1.1", "request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/200", "payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo", "classification_reason": "Motif SSRF \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b92f122a53a59b865677b09cad01a5724d680fa", "protocol_details": { "http_method": "POST", "http_path": "\/sdk", "request_line": "POST \/sdk HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Motif SSRF \u00b7 confiance 100%", "classification_reason_label_fr": "Motif SSRF \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 77, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 77, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "POST", "http_path": "\/sdk", "request_line": "POST \/sdk HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk", "evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8888\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mo", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 8 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "anomaly:scanner-ua", "http_jwt_body", "http_ssrf_body", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:54 UTC	TCP	199 · HTTP	http	Scan de ports port scan syn · via HTTP:199 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 199 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 199, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "a07359c200665fd7add17fabfe9779a8f087b469", "event_fingerprint": "ce401735047c79e55eacb1c06be224bc51320f5c", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 199, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6e6c836d61bb8bafd6eb82315767bcbb3ddc68cf", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 199, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:199 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "199" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.8, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua" ] }
18/07/2026 05:31:54 UTC	TCP	81 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:81 · (sonde / probe) · → /nmaplowercheck1784352718	—	Moyen · 59
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible /nmaplowercheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /nmaplowercheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozil Requête brute (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f", "http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 206, "payload_entropy": 5.2029916728697305, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 81, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 1, "campaign_key": "67fe9b83623439dff030f5db0a8dd1729a7738c9", "event_fingerprint": "e5a327c946bac23dbec004b040f34070b2d983a7", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "ee04a59b66a99bae1f05e6c3da1e325f", "path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "evidence": { "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "72cca0a83266f06cbcd4ec43c3fe0d9c9eb3615a", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 59, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nConnection: close\r\nUser-Agent: Mozil", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.06, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:54 UTC	TCP	81 · HTTP	http	Scan de ports port scan syn · via HTTP:81 · (reconnaissance) · → /sdk	—	Élevé · 76
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 TA0001 Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 81 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 76 Confiance : Confiance 100 % — 8 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 TA0001 Motifs de détection (base) CRS 921130 duplicate CL CRS 941130 LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Content-Length: 441 Connection: close User-Agent: Mozi Requête brute (extrait) POST /sdk HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:81 Content-Length: 441 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) <soap:Envelope xmlns:xsd="http://www.w3.org/2001/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "3f9d10f4878f3b807c4b03eb9bfacb2c8601632f", "http_target_hash": "5e2a035222ca1432dd7a4c0062da7711ee276c61", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 648, "payload_entropy": 5.271108735971403, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 81, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 15, "risk_granularity": 6, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 76, "tag_count": 13, "anomaly_count": 1, "campaign_key": "b0eb79ddaff70a8662e8b1b5d957b57842b65f9e", "event_fingerprint": "3bd20c458e6da8af13dfa8c2a8ec64794ce0b5c7", "classification_reason": "Motif SSRF \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0842", "pat-0284", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 941130", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0842", "pat-0284", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 76, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "13c516e06f7703ef1de5c499f0f6513c", "path_pattern_hash": "b91a94364e548eac8280a672094b6c64" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 76 }, "payload_preview": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi", "method": "POST", "path": "\/sdk", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "POST \/sdk HTTP\/1.1", "request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/2001\/", "payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi", "evidence": { "method": "POST", "path": "\/sdk", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "POST \/sdk HTTP\/1.1", "request_sample": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n<soap:Envelope xmlns:xsd=\"http:\/\/www.w3.org\/2001\/", "payload_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi", "classification_reason": "Motif SSRF \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "73155d17ba1f23ed972aaca4453f7b1c5b898144", "protocol_details": { "http_method": "POST", "http_path": "\/sdk", "request_line": "POST \/sdk HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi", "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Motif SSRF \u00b7 confiance 100%", "classification_reason_label_fr": "Motif SSRF \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 76, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 76, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "POST", "http_path": "\/sdk", "request_line": "POST \/sdk HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/sdk", "evidence_snippet": "POST \/sdk HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:81\r\nContent-Length: 441\r\nConnection: close\r\nUser-Agent: Mozi", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 8 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.06, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950079:sqli-19", "950326:rce-0", "950327:rce-0", "950406:ssrf-3", "950407:ssrf-3", "950470:nosqli-3", "950471:nosqli-3", "anomaly:scanner-ua", "http_jwt_body", "http_ssrf_body", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
18/07/2026 05:31:54 UTC	TCP	199 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:199 · (sonde / probe) · → /nmaplowercheck1784352718	—	Moyen · 57
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 199 Chemin / cible /nmaplowercheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 57 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /nmaplowercheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozi Requête brute (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:199 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "c594f73ad1ce8236237a9784f386fc92dc8c31a8", "http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 207, "payload_entropy": 5.225622530028717, "port_category": "well_known", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 199, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 1, "campaign_key": "c5fcbd9502a0674d01b705e8f7378361dd03fc86", "event_fingerprint": "d4c4f258616e019b4603d9c20c3854eae8824fac", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 57, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "0256d0ee6e310484b93ebc187eb40071", "path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341" }, "target_context": { "dst_port": 199, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi", "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi", "evidence": { "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2dbdf703c92af9132d92f744317087347b73291a", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi", "attack_vector": "scanner vuln \u00b7 via HTTP:199 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 57, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 199, "protocol_emulated": null, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 199, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:199 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:199\r\nConnection: close\r\nUser-Agent: Mozi", "target_port_label": "199 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "199" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.06, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "scanner-ua" ] }
18/07/2026 05:31:54 UTC	TCP	1720 · HTTP	http	Scan de ports port scan syn · via HTTP:1720 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1720 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 1720, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "2b7998c4ade4362021bbaf19219a9857622038d3", "event_fingerprint": "b0da2a9edddbb989ddc1033f6079605bf6efa436", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1720, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21890f6f004d56bff401597c330f7362c8883f16", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1720, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1720 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1720" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.32, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua" ] }
18/07/2026 05:31:54 UTC	TCP	1723 · PPTP	pptp	Scan de ports port scan syn · via PPTP:1723 · (reconnaissance)	—	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur PPTP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1723 Chemin / cible — Service PPTP Payload �+<M��nonenmap Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) UA nmap Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �+<M��nonenmap Meta JSON brut { "protocol_emulated": true, "emulator_response": "009a000100000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "emulator_response_len": 152, "bytes_in": 156, "payload_entropy": 1.0185126797061423, "port_category": "registered", "org": "Datacamp Limited", "service": "pptp", "app_proto": "pptp", "asn": 212238, "country": "JP", "dst_port": 1723, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7f571a2fce7c469bfc57d5e48b3a69201915b70e", "event_fingerprint": "71584713bb04b570046daaa2c28d60858e61192a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0448", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "UA nmap", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0448", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "pptp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4dd04af3dcb43d86d479b61344c6ee22", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1723, "service": "pptp", "service_name": "pptp", "risk_score": 42 }, "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fbe7bccd2ad2e1096217ff77f84a57df6591ce0b", "protocol_details": { "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1723, "service": "pptp", "service_label_fr": "PPTP" }, "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonenmap", "attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)", "target_port_label": "1723 \u00b7 PPTP", "emulator_service": "pptp", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via PPTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "pptp", "service_label_fr": "PPTP", "dst_port": 1723, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-pptp", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000nmap\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 1723, "service": "pptp", "service_label_fr": "PPTP" }, "attack_vector": "port scan syn \u00b7 via PPTP:1723 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonenmap", "target_port_label": "1723 \u00b7 PPTP", "emulator_service": "pptp", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "pptp", "service_banner": "honeypot-pptp", "service_os": "linux", "dst_port": "1723" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.58, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_pptp_probe", "pptp_emulated", "pptp_payload" ] }
18/07/2026 05:31:54 UTC	TCP	1720 · HTTP	http	Scan vulnérabilités scanner vuln · via HTTP:1720 · (sonde / probe) · → /nmaplowercheck1784352718	—	Moyen · 57
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1595 TA0007 TA0001 Protocole GET /nmaplowercheck1784352718 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1784352718 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1720 Chemin / cible /nmaplowercheck1784352718 Service HTTP Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 57 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux ET-SCAN-Nmap SIGMA-web-scanner-ua pat-0805 pat-0425 Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MITRE T1046 network scan LFI Double-dot bypass UA Nmap Scripting Engine UA nmap Sigma nmap UA Ligne de requête `GET /nmaplowercheck1784352718 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Moz Requête brute (extrait) GET /nmaplowercheck1784352718 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:1720 Connection: close User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1", "http_host_hash": "87a118bc4f8adb1808cea1d662665bbefaafbcaf", "http_target_hash": "ba73cbd92abe96802829f778f8005d617bed6460", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 208, "payload_entropy": 5.214321453752121, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "JP", "dst_port": 1720, "risk_waf": 96, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 1, "campaign_key": "bb307085f48b1abf02f743997447d433cdc7dff6", "event_fingerprint": "1bcb6317239ca02a9074c1f975ff05f9a1ea2a5c", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 328, "precision_signals": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "kb_rule_ids": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425", "pat-0448", "pat-0543" ], "matched_patterns": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "matched_pattern_names": [ "MITRE T1046 network scan", "LFI Double-dot bypass", "UA Nmap Scripting Engine", "UA nmap", "Sigma nmap UA" ], "pattern_ids": [ "pat-0805", "pat-0103", "pat-0425", "pat-0448", "pat-0543" ], "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 57, "correlation_boost": 18 }, "named_classification_skipped": false, "classification_parent": "vuln_scanner", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "330447dbae11331605ae65a34cb11832", "payload_hash": "04fafe41f17a887abb2448d62b1a61bc", "path_pattern_hash": "cf6626d5ab4a66836aa7503955a08341" }, "target_context": { "dst_port": 1720, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz", "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz", "evidence": { "method": "GET", "path": "\/nmaplowercheck1784352718", "user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "scanner-ua" ], "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "request_sample": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)\r\n\r\n", "payload_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz", "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b69f6cad6448af88d7d2e4ae8c84badad312032d", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz", "attack_vector": "scanner vuln \u00b7 via HTTP:1720 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (23 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 96, "classification": 60, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 30, "risk_score": 57, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1720, "protocol_emulated": null, "tags_summary": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "tags_summary_labels_fr": [ "ET-SCAN-Nmap", "SIGMA-web-scanner-ua", "pat-0805", "pat-0425" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/nmaplowercheck1784352718", "request_line": "GET \/nmaplowercheck1784352718 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Nmap Scripting Engine; https:\/\/nmap.org\/book\/nse.html)", "port": 1720, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "scanner vuln \u00b7 via HTTP:1720 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/nmaplowercheck1784352718", "evidence_snippet": "GET \/nmaplowercheck1784352718 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:1720\r\nConnection: close\r\nUser-Agent: Moz", "target_port_label": "1720 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1720" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 21, 22, 23, 81, 110, 111, 135, 143, 199, 445, 465, 548, 587, 993, 995, 1025 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.58, "multi_protocol_correlation": true, "multi_protocol_count": 23, "multi_protocol_sample": [ "afp", "ftp", "h323", "http", "http-alt-81", "imap", "imaps", "msrpc" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "scanner-ua" ] }

187.15.133.194

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence