25/07/2026 21:12:52 UTC
TCP
3310 · HTTP
http
http · via HTTP:3310 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3310
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61%
Confiance classification
69%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "http",
"app_proto": "http",
"asn": 63949,
"country": "US",
"dst_port": 3310,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5d7b8b7c282672231e0c55186a03753b2384605f",
"event_fingerprint": "30650f194590e4cbe1db9b6451023b16871d18dd",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.69,
"classification_confidence": 0.69,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c077fc1c341fe20597719e9dd5ec3ea976bc00dd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "http \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe)",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:3310 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua"
],
"asn_dc_heuristic": true
}
25/07/2026 21:12:51 UTC
TCP
3310
—
Sonde port
Sonde port · port 3310 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3310
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": null,
"app_proto": null,
"asn": 63949,
"country": "US",
"dst_port": 3310,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2cb6c394742bd0192356a1643ceec8cc37256193",
"event_fingerprint": "abadc453fb643677108d8be56d3ad690816c3f18",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3310,
"risk_score": 44
},
"payload_preview": "\r\n\r\n",
"request_sample": "\r\n\r\n",
"evidence": {
"request_sample": "\r\n\r\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d247148358512b603503292fd39738e3c5ec82b1",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"target_port_label": "3310",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3310",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
25/07/2026 21:12:50 UTC
TCP
3310
—
Sonde port
Sonde port · port 3310 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3310
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": null,
"app_proto": null,
"asn": 63949,
"country": "US",
"dst_port": 3310,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2cb6c394742bd0192356a1643ceec8cc37256193",
"event_fingerprint": "abadc453fb643677108d8be56d3ad690816c3f18",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3310,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6127bdb5e87f2ed0fb9bec2f830d63735ca2ca9f",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"target_port_label": "3310",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3310",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
16/07/2026 11:00:16 UTC
TCP
3381 · HTTP
http
http · via HTTP:3381 · (sonde / probe)
Faible
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3381
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61%
Confiance classification
69%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "http",
"app_proto": "http",
"asn": 63949,
"country": "US",
"dst_port": 3381,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9490e2ddcc07f360bc36364c21c34eb1004b4b87",
"event_fingerprint": "b860d38bc9fe654e754b6ec58e79eb4423269d15",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 3381,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.69,
"classification_confidence": 0.69,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f53be28cdfaee8c75a62cbb141453be140e3c148",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 3381,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "http \u00b7 via HTTP:3381 \u00b7 (sonde \/ probe)",
"target_port_label": "3381 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3381,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 3381,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:3381 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "3381 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3381"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3381"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua"
],
"asn_dc_heuristic": true
}
16/07/2026 11:00:15 UTC
TCP
3381
—
Sonde port
Sonde port · port 3381 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3381
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": null,
"app_proto": null,
"asn": 63949,
"country": "US",
"dst_port": 3381,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5752fb1d9961ee39164dcffc753e2096547ca8ae",
"event_fingerprint": "197c1e8f0a62643d8bcf642f1c374c77223a47de",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3381,
"risk_score": 44
},
"payload_preview": "\r\n\r\n",
"request_sample": "\r\n\r\n",
"evidence": {
"request_sample": "\r\n\r\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "037ae5cc060300051ff58cf791454de2546fd5cc",
"protocol_details": {
"port": 3381
},
"attack_vector": "Sonde port \u00b7 port 3381 \u00b7 (sonde \/ probe)",
"target_port_label": "3381",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3381,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3381
},
"attack_vector": "Sonde port \u00b7 port 3381 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3381",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3381"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
16/07/2026 11:00:14 UTC
TCP
3381
—
Sonde port
Sonde port · port 3381 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3381
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": null,
"app_proto": null,
"asn": 63949,
"country": "US",
"dst_port": 3381,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5752fb1d9961ee39164dcffc753e2096547ca8ae",
"event_fingerprint": "197c1e8f0a62643d8bcf642f1c374c77223a47de",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3381,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2191c8694a5d32dbe4db798a9b5347fd69a37eed",
"protocol_details": {
"port": 3381
},
"attack_vector": "Sonde port \u00b7 port 3381 \u00b7 (sonde \/ probe)",
"target_port_label": "3381",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3381,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3381
},
"attack_vector": "Sonde port \u00b7 port 3381 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3381",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3381"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
14/07/2026 15:17:37 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 cbcd1d81f242de31 SNI ABC-U6U673WEF
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
tls_clienthello
winrm_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
SNI TLS
ABC-U6U673WEF
Payload
t pYF}�3Ӣ'O��1p�F妢� } �O)u��� �� 5 /� � 8 2 / ABC-U6U673WEF �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t pYF}�3Ӣ'O��1p�F妢� } �O)u��� �� 5 /�
� 8 2
/
ABC-U6U673WEF
�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 121,
"payload_entropy": 4.905270087972374,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 35,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cbd20de6a5293450ab723d65c3e11e479b15d752",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 35
},
"service_name": "winrm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f1259f03732f4007ef7053cbd91b8852",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5",
"ja3": "cbcd1d81f242de31fd683d5acbc70dca",
"ja4": "aa2c14256328734fbc594089fa198c52",
"tls_version": "0x0301",
"tls_cipher_count": 12,
"tls_sni": "ABC-U6U673WEF",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "cbcd1d81f242de31fd683d5acbc70dca",
"tls_ja3": "769,49172-49171-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0",
"tls_ja4_hash": "aa2c14256328734fbc594089fa198c52",
"tls_ja4": "t13d0112_b95786268cb1_d63375ab50e9",
"tls_version": "0x0301",
"tls_cipher_count": 12,
"tls_sni": "ABC-U6U673WEF",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc45a06f9f03a6df2163383fdecde1e55a5a0709",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca",
"tls_ja4": "aa2c14256328734fbc594089fa198c52",
"tls_sni": "ABC-U6U673WEF",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca",
"tls_ja4": "aa2c14256328734fbc594089fa198c52",
"tls_sni": "ABC-U6U673WEF",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"tls_clienthello",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:37 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
� ,�:��H����Pq���S��:�3o)S}���bζ ��7>�v��E�D���A��� ����)k�c]V�V�_T t� ��w�M=[1����g^��K��>�k�����H��D�`k��e ��{_LP
Pourquoi cette classification : Rafale d'authentification SSH · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0577
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ,�:��H����Pq���S��:�3o)S}���bζ ��7>�v��E�D���A��� ����)k�c]V�V�_T t� ��w�M=[1����g^��K��>�k�����H��D�`k��e ��{_LP
Requête brute (extrait)
� ,�:��H����Pq���S��:�3o)S}���bζ ��7>�v��E�D���A��� ����)k�c]V�V�_T t� ��w�M=[1����g^��K��>�k�����H��D�`k��e ��{_LP� ���J
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 136,
"payload_entropy": 6.556105028702606,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d302edc971d0b01724b979c596a19316bdba828b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0577"
],
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"service_name": "winrm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c06fc23d2f224f4eb425bd383053b222",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 35
},
"payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
"request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ",
"payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
"evidence": {
"request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ",
"payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c276c9b28175525434d70ceb5adbf021e5058ee",
"protocol_details": {
"payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 50%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0577"
],
"tags_summary_labels_fr": [
"pat-0577"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:37 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
����E�������������������������������������0�����������������������&����������!����&� ���� ����������+��������� �#���
Pourquoi cette classification : Rafale d'authentification SSH · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����E�������������������������������������0�����������������������&����������!����&� ����
����������+��������� �#���
Requête brute (extrait)
����E�������������������������������������0�����������������������&����������!����&� ���� ����������+��������� �#�������������������
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 144,
"payload_entropy": 3.7524121173816725,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 24,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d302edc971d0b01724b979c596a19316bdba828b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4c08b667ad2290ced22cda22075fd99b",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e40590cd734811a680fcd0ca8dd8e9704b0de7a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:37 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
;Bo3�D��si=����:�ɮ�<0�8�� �N��<oN����/��* �C �4]��PVf��ȣ+b��
Pourquoi cette classification : Rafale d'authentification SSH · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
;Bo3�D��si=����:�ɮ�<0�8�� �N��<oN����/��* �C �4]��PVf��ȣ+b��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 78,
"payload_entropy": 5.952068885528922,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 24,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d302edc971d0b01724b979c596a19316bdba828b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "07542c6becaecdcdca50a371ce717331",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"evidence": {
"request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "549b0f7a6559edc3de7d95bdf65fad3fd4511b8a",
"protocol_details": {
"payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:36 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
Gh0st� � x�KS``�����Č@�Q��� H��e&�*$&g+2���00��rc �� \`&��K7��n 9�n ;�3��sch�^�4'J����0Ñh]&��ΗS�A4L?2=�Ē� @�` T
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
Gh0st� � x�KS``�����Č@�Q��� H��e&�*$&g+2���00��rc �� \`&��K7��n 9�n ;�3��sch�^�4'J����0Ñh]&��ΗS�A4L?2=�Ē� @�` T
Requête brute (extrait)
Gh0st� � x�KS``�����Č@�Q��� H��e&�*$&g+2���00��rc �� \`&��K7��n 9�n ;�3��sch�^�4'J����0Ñh]&��ΗS�A4L?2=�Ē� @�` T ��] r #��~�+m�=�tC,C�L<<==\�� � T�+\
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 173,
"payload_entropy": 6.526774759278568,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"service_name": "winrm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ac4eb53f5e8dfbbbaca7212ed0125e98",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 35
},
"payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
"request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\",
"payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
"evidence": {
"request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\",
"payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84032d33e1ce604bcd80552f560d96e803db3ea7",
"protocol_details": {
"payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd*$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd*$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:36 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d
Requête brute (extrait)
145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 280,
"payload_entropy": 5.4072640905205,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88230f14a43950fa1f87f2ce9b5783a9",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"request_sample": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp",
"payload_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"evidence": {
"request_sample": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp",
"payload_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14f1c28c03da5f245ae9970876ebf856e265a39f",
"protocol_details": {
"payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:36 UTC
TCP
5985 · WINRM
Protocole TDS MSSQL
mssql tds · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
H tj��#D�+��l���J n��xu[l�E -j��xL�r�u�%�Rtgfv�]%̀ �Ϯ ��fȍD� �
Pourquoi cette classification : Rafale d'authentification SSH · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0356
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
H tj��#D�+��l���J n��xu[l�E -j��xL�r�u�%�Rtgfv�]%̀ �Ϯ ��fȍD� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 76,
"payload_entropy": 5.800559092390959,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 32,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d302edc971d0b01724b979c596a19316bdba828b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0356"
],
"kb_rule_ids": [
"pat-0356"
],
"matched_patterns": [
"pat-0356",
"pat-0554"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0356",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ce42628f54668ae436e0cba19c9ae85c",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 32
},
"payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"evidence": {
"request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97be13cddbbbdc5ef68157fa65d94e6cb93dd86f",
"protocol_details": {
"payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"attack_vector": "mssql tds \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0356"
],
"tags_summary_labels_fr": [
"pat-0356"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "mssql tds \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:36 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
batman
Pourquoi cette classification : Rafale d'authentification SSH · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 6,
"payload_entropy": 2.2516291673878226,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 24,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d302edc971d0b01724b979c596a19316bdba828b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1532e76dbe9d43d0dea98c331ca5ae8a",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "batman",
"request_sample": "batman",
"payload_snippet": "batman",
"evidence": {
"request_sample": "batman",
"payload_snippet": "batman",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bdfde848eb0e18f79a6c6b510e254e6daa5faa60",
"protocol_details": {
"payload_preview": "batman",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "batman",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 0%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "batman",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "batman",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:35 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
GET / HTTP/1.0
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 18,
"payload_entropy": 3.461320140211008,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 0
},
"risk_score": 24,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "517cc1b4bef40760fee9c1649c6c0bb752cac87d",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"evidence": {
"request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bf565ba3cb3ade1e3cce47751f45bff063e6c82",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.0",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "GET \/ HTTP\/1.0",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.0",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.0",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:35 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
A fH�d~���g������ ��T��Z��?���t0\���X��J��ȜlМ�����ˏ���J�<��`
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
A fH�d~���g������ ��T��Z��?���t0\���X��J��ȜlМ�����ˏ���J�<��`
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 69,
"payload_entropy": 5.767803079903862,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"service_name": "winrm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c12d37882087cf9ca03116d828e11245",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 35
},
"payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"evidence": {
"request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c55ce20dee067a2c10a45c0dd9795937999c9a0",
"protocol_details": {
"payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:35 UTC
TCP
5985 · WINRM
Sonde OPC-UA
opcua probe · via WINRM:5985 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
HELP
Pourquoi cette classification : Type « opcua_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0626
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
OPC UA HEL
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 6,
"payload_entropy": 2.584962500721156,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0626"
],
"kb_rule_ids": [
"pat-0626"
],
"matched_patterns": [
"pat-0626"
],
"matched_pattern_names": [
"OPC UA HEL"
],
"pattern_ids": [
"pat-0626"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fb323af48498fcb3974ce6b1881c8797",
"path_pattern_hash": "9665a326f7d8f70f1661dab78807b951"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 40
},
"payload_preview": "HELP\r\n",
"request_sample": "HELP\r\n",
"payload_snippet": "HELP",
"evidence": {
"request_sample": "HELP\r\n",
"payload_snippet": "HELP",
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b1200bcd89abc6419fc31744fc9ff26f96cf01e",
"protocol_details": {
"payload_preview": "HELP",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "HELP",
"attack_vector": "opcua probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0626"
],
"tags_summary_labels_fr": [
"pat-0626"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "HELP",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "opcua probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HELP",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:35 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 117,
"payload_entropy": 4.175258830258507,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2d2685956f7f410604536189c003f5c",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"request_sample": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"payload_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"evidence": {
"request_sample": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"payload_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d808612ba7b608402eb970d2fe341fd77c0955ff",
"protocol_details": {
"payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:35 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Service
WINRM
Payload
�հ]�ē�0�X�ڱ�n � 3*�� '��k�� G�W �zOe��aFCysA����C�p�*����b�vG�/��&o�@Jz��3iBQ�Q� ۔�b2M"�� ��Z�&e� �
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0514
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�հ]�ē�0�X�ڱ�n � 3*�� '��k��
G�W �zOe��aFCysA����C�p�*����b�vG�/��&o�@Jz��3iBQ�Q� ۔�b2M"�� ��Z�&e� �
Requête brute (extrait)
�հ]�ē�0�X�ڱ�n � 3*�� '��k�� G�W �zOe��aFCysA����C�p�*����b�vG�/��&o�@Jz��3iBQ�Q� ۔�b2M"�� ��Z�&e� � X'��ͤGH /~s;`(&)�K_�� ��Y7��� n��*#�L �����sz s�W��/��0*�~3E]�M�ؑ��Ց��ь��(�����"eUY�E:I2_��� \�~� c~��rZ�/U��f�fi
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"bytes_in": 518,
"payload_entropy": 7.586688001255927,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0514"
],
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"service_name": "winrm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3699d67b1c1d3f5e51e94c25bf3415b4",
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 35
},
"payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\r",
"request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd*#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0*\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi",
"payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
"evidence": {
"request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd*#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0*\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi",
"payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb285aa8c51a9db7734d462a9b7a387ee3d1da21",
"protocol_details": {
"payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3*\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd",
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": [
"pat-0514"
],
"tags_summary_labels_fr": [
"pat-0514"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3*\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated",
"winrm_payload"
],
"asn_dc_heuristic": true
}
14/07/2026 15:17:33 UTC
TCP
5985 · WINRM
Sonde WinRM
winrm probe · via WINRM:5985 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
winrm_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5985
Chemin / cible
—
Pourquoi cette classification : Type « winrm_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 77,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Akamai Connected Cloud",
"service": "winrm",
"app_proto": "winrm",
"asn": 63949,
"country": "US",
"dst_port": 5985,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 24,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c549abcc3c12627af589696228cecd16670f21b5",
"event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "winrm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
},
"target_context": {
"dst_port": 5985,
"service": "winrm",
"service_name": "winrm",
"risk_score": 24
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afb8fcf9ef5a81814179d51060cc7b145afadc8c",
"protocol_details": {
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "winrm",
"service_label_fr": "WINRM",
"dst_port": 5985,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5985,
"service": "winrm",
"service_label_fr": "WINRM"
},
"attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5985 \u00b7 WINRM",
"emulator_service": "winrm",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm",
"service_banner": "honeypot-winrm",
"service_os": "linux",
"dst_port": "5985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_winrm_probe",
"winrm_emulated"
],
"asn_dc_heuristic": true
}