Détails IP 192.53.123.202

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

tls_probe

Comparaison ASN / FAI

ASN 63949 · 192.53.120.0/22 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 10 événements sur la période pour cette IP.

45.33.70.184 Sonde port 18/07/2026 21:59 UTC
45.33.90.191 Sonde port 18/07/2026 21:22 UTC
170.187.145.59 Sonde port 18/07/2026 21:16 UTC
170.187.147.240 Sonde port 18/07/2026 20:42 UTC
139.177.194.207 Sonde port 18/07/2026 20:25 UTC
198.58.111.250 Sonde port 18/07/2026 20:13 UTC
80.85.84.68 citrix ica probe 18/07/2026 19:43 UTC
23.239.29.212 Sonde port 18/07/2026 19:40 UTC

IPs apparentées

Même FAI Akamai Connected Cloud — corrélation indicative.

45.33.70.184 Sonde port
45.33.90.191 Sonde port
170.187.145.59 Sonde port
170.187.147.240 Sonde port
139.177.194.207 Sonde port

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

10 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 17:33:20 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 013c30c8ce44c8b2 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��ip�n��sUxR� ��u�RV�膺�� w(�ޚaogG֗TSCM� ��2�R WY��A��=5��</ ��̨�w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��ip�n��sUxR� ��u�RV�膺�� w(�ޚaogG֗TSCM� ��2�R WY��A��=5��</ ��̨�w Requête brute (extrait) ��ip�n��sUxR� ��u�RV�膺�� w(�ޚaogG֗TSCM� ��2�R WY��A��=5��</ ��̨�w�v�a�`�0�(��/�'��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 426, "payload_entropy": 6.0160486279855165, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "1ee6b107c802b7de6ce3c2d26aba557b14eca19d", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "payload_hash": "409dd1fb6accfbde07b91341a03dba77", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "586d93fc5898d8f9a7462db28737057e54d76b03", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:20 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 917fde1bf3bcb67f SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��%֐(��?e �2��aĻK��c�qK \|B�6 �;6��Og�4 �uD!Kq�L?>"�3g��9k��E�� #��+� �$�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��%֐(��?e �2��aĻK��c�qK \|B�6�;6��Og�4 �uD!Kq�L?>"�3g��9k��E�� #��+� �$�� Requête brute (extrait) ��%֐(��?e �2��aĻK��c�qK \|B�6 �;6��Og�4 �uD!Kq�L?>"�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 416, "payload_entropy": 5.9935032025692925, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "52cc6850fb7978546653ec286dc22ef0b09d07a0", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "917fde1bf3bcb67f961b77b18d9ee14a", "payload_hash": "1cd16e6f4da64015fc8dec4240bde073", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012\|B\u001f\ufffd6\f\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012\|B\u001f\ufffd6\f\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012\|B\u001f\ufffd6\f\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcdd1096ab6540fda4cac9241dcad74eca71ecc8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012\|B\u001f\ufffd6\f\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK \|B\ufffd6\ufffd;6\ufffd\ufffdOg\ufffd4\r\ufffduD!Kq\ufffdL?>\"\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012\|B\u001f\ufffd6\f\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK \|B\ufffd6*\ufffd;6\ufffd\ufffdOg\ufffd4\r\ufffduD!Kq\ufffdL?>\"\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:20 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 45ce27f47e0f147e SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��E��MWe��]/]�1ʉ?��%I��E��\|9� jW5lm���6��n �gQ��2��m��'�/��(�0�`�a�v�w̨�� /<��5 Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��E��MWe��]/]�1ʉ?��%I��E��\|9� jW5lm���6��n �gQ��2��m��'�/��(�0�`�a�v�w̨�� /<��5 Requête brute (extrait) ��E��MWe��]/]�1ʉ?��%I��E��\|9� jW5lm���6��n �gQ��2��m��'�/��(�0�`�a�v�w̨�� /<��5=��A��̩�s�r�,��$� �+��#� ��E��k9��g3�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "45ce27f47e0f147e54ede25a4b0553fd", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 439, "payload_entropy": 6.052247549523526, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "5d276096f366a988cacd7c5112548d8958fd1049", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "45ce27f47e0f147e54ede25a4b0553fd", "payload_hash": "e4f084863ae6e002ff587243070e4445", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd\|9\ufffd j\u001c\u001bW5\u0001lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd\|9\ufffd j\u001c\u001bW5\u0001lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd\|9\ufffd j\u001c\u001bW5\u0001lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3718fbcbb69f1dcc289e87f20e35cdd720f8e7b7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd\|9\ufffd j\u001c\u001bW5\u0001lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "tls_ja3": "45ce27f47e0f147e54ede25a4b0553fd", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd\|9\ufffd jW5lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd\|9\ufffd j\u001c\u001bW5\u0001lm\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "tls_ja3": "45ce27f47e0f147e54ede25a4b0553fd", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd\|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:19 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 03a3ad27040f733e SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload TPZ��~�H,�~��-f��싦�C0x�I\|M� �(��\|��ʳ��u1��$�D�� I�)F��̩�s�r�,��$� �+��#� ��E� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) TPZ��~�H,�~��-f��싦�C0x�I\|M� �(��\|��ʳ��u1��$�D�� I�)F��̩�s�r�,��$� �+��#� ��E� Requête brute (extrait) TPZ��~�H,�~��-f��싦�C0x�I\|M� �(��\|��ʳ��u1��$�D�� I�)F��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� #<:http/0.9http/1.0http/1.1spdy/1spdy/2 Meta JSON brut { "tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 9, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 345, "payload_entropy": 6.0456487669258765, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "2d4f6250da93227e78d9b8d165e24bcfdd5b0bba", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "03a3ad27040f733ee5c9915e0903d028", "payload_hash": "2d6c2f2e7f4842da4e76916e3c6aab57", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2", "payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6bc96f2889c1e85f351a5eea42e1a2d6c8189023", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "tls_ja3": "03a3ad27040f733ee5c9915e0903d028", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd", "tls_ja3": "03a3ad27040f733ee5c9915e0903d028", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI\|M\ufffd \ufffd(\ufffd\ufffd\|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:19 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 a96dc3876784813c SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload FB�q�N��4�tL��}2 ��c�3��j� �.e��'�5h�x�p�}��G�� �2�B�D��'�/��(�0�`�a�v�w̨�� /<��5=�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) FB�q�N��4�tL��}2 ��c�3��j� �.e��'�5h�x�p�}��G���2�B�D��'�/��(�0�`�a�v�w̨�� /<��5=�� Requête brute (extrait) FB�q�N��4�tL��}2 ��c�3��j� �.e��'�5h�x�p�}��G�� �2�B�D��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� #0.http/0.9http/1.0spdy/1spdy/2spdy/3h2c Meta JSON brut { "tls_ja3_hash": "a96dc3876784813c57d302241e620acd", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 11, "tls_alpn": [ "http\/0.9", "http\/1.0", "spdy\/1", "spdy\/2", "spdy\/3", "h2c", "hq" ], "bytes_in": 331, "payload_entropy": 5.961672617475028, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "02cf4e4f6dadc37adcda17d6845139e5524e71e8", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "a96dc3876784813c57d302241e620acd", "payload_hash": "0d910ccbaa6adb7005e20732d89824e9", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c", "payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a73727ff69c99f6d9607028c3f5cb16f1e7a440", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "tls_ja3": "a96dc3876784813c57d302241e620acd", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffdB\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd", "tls_ja3": "a96dc3876784813c57d302241e620acd", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd2\ufffdB\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:19 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 4333f94fe0ad43e0 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��ۻ��^���Xw��\��O! H��W<?B�n�(��F�G��e2L �/��tA�N��'�/��(�0�`�a�v�w̨�� /<��5 Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��ۻ��^���Xw��\��O! H��W<?B�n�(��F�G��e2L �/��tA�N��'�/��(�0�`�a�v�w̨�� /<��5 Requête brute (extrait) ��ۻ��^���Xw��\��O! H��W<?B�n�(��F�G��e2L �/��tA�N��'�/��(�0�`�a�v�w̨�� /<��5=��A��̩�s�r�,��$� �+��#� ��E��k9��g3�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "4333f94fe0ad43e0ba73e398e869a517", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "hq", "h2c", "spdy\/3", "spdy\/2", "spdy\/1", "http\/1.0", "http\/0.9" ], "bytes_in": 412, "payload_entropy": 6.006280478298539, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "eaa02b00673b0c0397e3ec1b719213543af6b211", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "4333f94fe0ad43e0ba73e398e869a517", "payload_hash": "b8fa01595040b6b97a7d6f9bc9eefd61", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c0720209568f0080fd2ed1985bfbca30c92bced", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "tls_ja3": "4333f94fe0ad43e0ba73e398e869a517", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO! H\ufffd\ufffdW<?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005", "tls_ja3": "4333f94fe0ad43e0ba73e398e869a517", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO! H\ufffd\ufffdW<?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:19 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 006315b3ad276906 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��<8��"��0gK�W ӱ}{R�>�E��!�� A��z�s�{Ʋ� ��q�&�ވ �3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��<8��"��0gK�W ӱ}{R�>�E��!�� A��z�s�{Ʋ� ��q�&�ވ �3g��9k��E�� #��+� �$�� Requête brute (extrait) ��<8��"��0gK�W ӱ}{R�>�E��!�� A��z�s�{Ʋ� ��q�&�ވ �3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 413, "payload_entropy": 5.986393355343536, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "f62e5863e5d6153e0cd71510048ed155760e6a2a", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "006315b3ad276906ff11527f9594e5ba", "payload_hash": "d205e2b71c96f29c366529938b5e73ab", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc4641124f47d76e2c2c211513c33c0b2eeacb93", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "006315b3ad276906ff11527f9594e5ba", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd<8\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "006315b3ad276906ff11527f9594e5ba", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd<8\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:19 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 db8d4ad49cb378fa SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��r�Nd)��A��[y��A�� q#zc�ŋ\~; ��S��?�� C��B��󼸻��3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��r�Nd)��A��[y��A�� q#zc�ŋ\~; ��S��?�� C��B��󼸻��3g��9k��E�� #��+� �$�� Requête brute (extrait) ��r�Nd)��A��[y��A�� q#zc�ŋ\~; ��S��?�� C��B��󼸻��3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 426, "payload_entropy": 5.91610690677172, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "3a3719ba6eace904aeb0318424c3bef62cfd24f7", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "payload_hash": "da2918abd50d009c76aeacf56bd89da4", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a3bad4dad3202a4096aea478103d4fabef3bd9b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\ufffd\u014b\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\ufffd\u014b\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:18 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 db8d4ad49cb378fa SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��gHn�yM>%��Q �z g��ϧ ��U}�Y ��ƥ�cF� ��}�~ �'F�3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��gHn�yM>%��Q �z g��ϧ ��U}�Y ��ƥ�cF� ��}�~�'F�3g��9k��E�� #��+� �$�� Requête brute (extrait) ��gHn�yM>%��Q �z g��ϧ ��U}�Y ��ƥ�cF� ��}�~ �'F�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 424, "payload_entropy": 6.021621769766911, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "3a3719ba6eace904aeb0318424c3bef62cfd24f7", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "payload_hash": "e1f390fc8437390bb28c676d41fa958c", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ed68bf7b8c6ce9efc7207e5fbb4e1b285b4f704", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdgHn\ufffdyM>%\ufffd\ufffd\ufffdQ \ufffdz\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\ufffd'F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdgHn\ufffdyM>%\ufffd\ufffd\ufffdQ \ufffdz\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\ufffd'F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }
18/07/2026 17:33:18 UTC	TCP	992 · TLS	tls	Sonde TLS tls probe · via TLS:992 · (sonde / probe)	—	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 013c30c8ce44c8b2 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 992 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload ��T��<ؐ��9�ï��eX� �E�3'��O �VL�7��X��{Zg�Ru4��y-c�[��A��=5��</ ��̨�w Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��T��<ؐ��9�ï��eX� �E�3'��O �VL�7��X��{Zg�Ru4��y-c�[��A��=5��</ ��̨�w Requête brute (extrait) ��T��<ؐ��9�ï��eX� �E�3'��O �VL�7��X��{Zg�Ru4��y-c�[��A��=5��</ ��̨�w�v�a�`�0�(��/�'��̩�s�r�,��$� �+��#� ��E��k9��g3� 62.3.50.33� Meta JSON brut { "tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "tls_alpn": [ "http\/0.9", "http\/1.0", "http\/1.1", "spdy\/1", "spdy\/2", "spdy\/3", "h2", "h2c", "hq" ], "bytes_in": 424, "payload_entropy": 6.0140810797363145, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "tls", "app_proto": "tls", "asn": 63949, "country": "CA", "dst_port": 992, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff", "event_fingerprint": "1ee6b107c802b7de6ce3c2d26aba557b14eca19d", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "CA", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "payload_hash": "64d099585a63969c44a66dcf0176ebd8", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 992, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "evidence": { "request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1f4ce499015d82af6afaf9f596eb6925c9bc9cd0", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd<\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 992, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw", "tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283", "tls_sni": "62.3.50.33", "port": 992, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd<\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw", "target_port_label": "992 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "992" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

192.53.123.202

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence