|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �ip�n����sUx R� ����u�RV�膺�� �w(�ޚaogG֗TSCM� ����2�R WY� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ip�n����sUx R�
����u�RV�膺�� �w(�ޚaogG֗TSCM� ����2�R
WY� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �ip�n����sUx R� ����u�RV�膺�� �w(�ޚaogG֗TSCM� ����2�R WY� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.0160486279855165,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "1ee6b107c802b7de6ce3c2d26aba557b14eca19d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "409dd1fb6accfbde07b91341a03dba77",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "586d93fc5898d8f9a7462db28737057e54d76b03",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\u001eR\ufffd\r\u000f\ufffd\ufffd\ufffd\u0016\ufffdu\ufffdRV\ufffd\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\u0002\ufffd\t\ufffd\ufffd\ufffd\b\ufffd2\ufffdR\nWY\ufffd\u000e\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �%(����?e �2��aĻ K���c�qK |B �6 *�;6��Og�4 �uD!Kq�L?>" � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �%(����?e
�2��aĻ K���c�qK |B �6 *�;6��Og�4
�uD!Kq�L?>" � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �%(����?e �2��aĻ K���c�qK |B �6 *�;6��Og�4 �uD!Kq�L?>" � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.9935032025692925,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "52cc6850fb7978546653ec286dc22ef0b09d07a0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "1cd16e6f4da64015fc8dec4240bde073",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012|B\u001f\ufffd6\f*\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012|B\u001f\ufffd6\f*\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012|B\u001f\ufffd6\f*\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcdd1096ab6540fda4cac9241dcad74eca71ecc8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012|B\u001f\ufffd6\f*\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK |B\ufffd6*\ufffd;6\ufffd\ufffdOg\ufffd4\r\ufffduD!Kq\ufffdL?>\"\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003%\u0590(\u0007\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013b\b\u001dK\ufffd\ufffd\ufffdc\ufffdqK\u001a \u0012|B\u001f\ufffd6\f*\ufffd;6\ufffd\ufffdO\u0019\u0004g\ufffd4\r\ufffd\u0001uD!Kq\ufffdL?>\"\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK |B\ufffd6*\ufffd;6\ufffd\ufffdOg\ufffd4\r\ufffduD!Kq\ufffdL?>\"\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 45ce27f47e0f147e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��E���MWe��]/]�1ʉ?��%I��E��|9� j W5lm�*���6�����n �gQ���2��m ������'�/��(�0�`�a�v�w̨�� / <���� � 5
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��E���MWe��]/]�1ʉ?��%I��E��|9� j W5lm�*���6�����n
�gQ���2��m ������'�/��(�0�`�a�v�w̨��
/ <���� � 5
Requête brute (extrait)
� ��E���MWe��]/]�1ʉ?��%I��E��|9� j W5lm�*���6�����n �gQ���2��m ������'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � ��̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "45ce27f47e0f147e54ede25a4b0553fd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 439,
"payload_entropy": 6.052247549523526,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "5d276096f366a988cacd7c5112548d8958fd1049",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "45ce27f47e0f147e54ede25a4b0553fd",
"payload_hash": "e4f084863ae6e002ff587243070e4445",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3718fbcbb69f1dcc289e87f20e35cdd720f8e7b7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"tls_ja3": "45ce27f47e0f147e54ede25a4b0553fd",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"tls_ja3": "45ce27f47e0f147e54ede25a4b0553fd",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T PZ���~�H,�~���-f���싦�C0x�I|M� �(��|� ��ʳ��u1���$�D���� �I�) F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T PZ���~�H,�~���-f���싦�C0x�I|M� �(��|� ��ʳ��u1���$�D����
�I�) F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T PZ���~�H,�~���-f���싦�C0x�I|M� �(��|� ��ʳ��u1���$�D���� �I�) F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.0456487669258765,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "2d4f6250da93227e78d9b8d165e24bcfdd5b0bba",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "2d6c2f2e7f4842da4e76916e3c6aab57",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bc96f2889c1e85f351a5eea42e1a2d6c8189023",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003Z\ufffd\ufffd\ufffd~\u0004\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\u0000\ufffd\ufffd\u02b3\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\u0016\ufffd\ufffd\r\ufffdI\ufffd)\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�q�N��4�tL�����}2 ���c�3���� j� �. e��'�5h�x�p�}��G����� *�2�B� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�q�N��4�tL�����}2 ���c�3���� j� �. e��'�5h�x�p�}��G����� *�2�B� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�q�N��4�tL�����}2 ���c�3���� j� �. e��'�5h�x�p�}��G����� *�2�B� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.961672617475028,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "02cf4e4f6dadc37adcda17d6845139e5524e71e8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "0d910ccbaa6adb7005e20732d89824e9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f*\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f*\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f*\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a73727ff69c99f6d9607028c3f5cb16f1e7a440",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f*\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd2\ufffdB\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\u001fj\ufffd \ufffd.\u001ee\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\f*\ufffd2\ufffdB\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd'\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd2\ufffdB\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4333f94fe0ad43e0 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��ۻ������^�*����Xw���\��O! H��W<?B�n�(��F�G��e2L �/��tA�N ������'�/��(�0�`�a�v�w̨�� / <���� � 5
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ۻ������^�*����Xw���\��O! H��W<?B�n�(��F�G��e2L
�/��tA�N ������'�/��(�0�`�a�v�w̨��
/ <���� � 5
Requête brute (extrait)
� ��ۻ������^�*����Xw���\��O! H��W<?B�n�(��F�G��e2L �/��tA�N ������'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � ��̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "4333f94fe0ad43e0ba73e398e869a517",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.006280478298539,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "eaa02b00673b0c0397e3ec1b719213543af6b211",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "4333f94fe0ad43e0ba73e398e869a517",
"payload_hash": "b8fa01595040b6b97a7d6f9bc9eefd61",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c0720209568f0080fd2ed1985bfbca30c92bced",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"tls_ja3": "4333f94fe0ad43e0ba73e398e869a517",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO! H\ufffd\ufffdW<?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u06fb\ufffd\u0005\ufffd\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO!\u0011\u0005 H\ufffd\ufffdW<?B\ufffdn\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\u001b\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005",
"tls_ja3": "4333f94fe0ad43e0ba73e398e869a517",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\ufffd\ufffdO! H\ufffd\ufffdW<?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �<8��"��0gK�W ӱ}{R�> �E��!�� A��z�s�{Ʋ� ����� ���q�&�ވ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �<8��"��0gK�W
ӱ}{R�> �E��!�� A��z�s�{Ʋ�
����� ���q�&�ވ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �<8��"��0gK�W ӱ}{R�> �E��!�� A��z�s�{Ʋ� ����� ���q�&�ވ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.986393355343536,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "f62e5863e5d6153e0cd71510048ed155760e6a2a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "d205e2b71c96f29c366529938b5e73ab",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc4641124f47d76e2c2c211513c33c0b2eeacb93",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd<8\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002<8\u0017\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\u001e\ufffd\u0014E\u0005\ufffd\ufffd!\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\u0014{\u01b2\ufffd\n\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\u0000\u0002\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd<8\ufffd\ufffd\"\ufffd\ufffd0gK\ufffdW\n\u04f1}{R\ufffd>\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd&\ufffd\u0788\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��r�Nd)��A��[y��A�� �q#zc �ŋ\~; �� S���?��� �C�����B��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��r�Nd)��A��[y��A�� �q#zc �ŋ\~; �� S���?���
�C�����B��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��r�Nd)��A��[y��A�� �q#zc �ŋ\~; �� S���?��� �C�����B��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.91610690677172,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "3a3719ba6eace904aeb0318424c3bef62cfd24f7",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "da2918abd50d009c76aeacf56bd89da4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a3bad4dad3202a4096aea478103d4fabef3bd9b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\ufffd\u014b\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\u001c\ufffd\u014b\\\u0006~; \u0011\ufffd\ufffd\u0000S\ufffd\ufffd\ufffd\u0013?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0011\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\t\ufffdq#zc\ufffd\u014b\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �gHn�yM>%���Q �z g��������ϧ ��U}� Y ���ƥ�cF� ��}�~ �'F � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �gHn�yM>%���Q �z
g��������ϧ ��U}� Y
���ƥ�cF�
��}�~ �'F � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �gHn�yM>%���Q �z g��������ϧ ��U}� Y ���ƥ�cF� ��}�~ �'F � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.021621769766911,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "3a3719ba6eace904aeb0318424c3bef62cfd24f7",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "e1f390fc8437390bb28c676d41fa958c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ed68bf7b8c6ce9efc7207e5fbb4e1b285b4f704",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdgHn\ufffdyM>%\ufffd\ufffd\ufffdQ \ufffdz\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\ufffd'F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0013Hn\ufffd\u0017\u0017yM>%\u001b\ufffd\ufffd\ufffdQ \ufffdz\r\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\u0005\ufffd\u001eY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\u000b\ufffd'\u0019F\u0016\u0015\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdgHn\ufffdyM>%\ufffd\ufffd\ufffdQ \ufffdz\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\r\ufffd\ufffd}\ufffd~\ufffd'F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
992 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:992 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
992
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �T� ��<ؐ���9�ï��eX� �E�3'��O �VL�7��X��{Zg�Ru4�������y-c�[� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �T� ��<ؐ���9�ï��eX�
�E�3'��O �VL�7��X��{Zg�Ru4�������y-c�[� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �T� ��<ؐ���9�ï��eX� �E�3'��O �VL�7��X��{Zg�Ru4�������y-c�[� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.0140810797363145,
"port_category": "well_known",
"org": "Akamai Connected Cloud",
"service": "tls",
"app_proto": "tls",
"asn": 63949,
"country": "CA",
"dst_port": 992,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "92607e36297c2dd7c26ee15a59f560ce4af7adff",
"event_fingerprint": "1ee6b107c802b7de6ce3c2d26aba557b14eca19d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 63949,
"org": "Akamai Connected Cloud",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "64d099585a63969c44a66dcf0176ebd8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 992,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f4ce499015d82af6afaf9f596eb6925c9bc9cd0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd<\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 992,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\u0014\u001f\ufffd\ufffd<\u0610\ufffd\ufffd\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\u0012\ufffd\ufffdO \ufffdV\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\u0018\ufffd[\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd<\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\r\ufffdE\ufffd3'\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|