14/07/2026 00:20:49 UTC
TCP
8082 · HTTP ALT 8082
proxy probe
proxy probe · via HTTP ALT 8082:8082 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8082
WAF
—
Recommandation
Surveiller
Tags
net_proxy_probe
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8082
Chemin / cible
—
Service
HTTP ALT 8082
Payload
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http-alt-8082",
"app_proto": "http-alt-8082",
"asn": 48090,
"country": "BG",
"dst_port": 8082,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "77dd11f56abc3fd6ae49411511227387e12c21dd",
"event_fingerprint": "e56c812f963cdd84f53c96e16b478b5272021669",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "http-alt-8082",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 8082,
"service": "http-alt-8082",
"service_name": "http-alt-8082",
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a38cb25a780ed5be488d9d16b4db2743d8b2126",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8082,
"service": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082"
},
"attack_vector": "proxy probe \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)",
"target_port_label": "8082 \u00b7 HTTP ALT 8082",
"emulator_service": "http-alt-8082",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082",
"dst_port": 8082,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8082",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8082,
"service": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082"
},
"attack_vector": "proxy probe \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8082 \u00b7 HTTP ALT 8082",
"emulator_service": "http-alt-8082",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8082",
"service_banner": "honeypot-http-alt-8082",
"service_os": "linux",
"dst_port": "8082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"http-alt-8082",
"port:7890",
"port:8118"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_proxy_probe",
"socks5_greeting"
]
}
14/07/2026 00:20:19 UTC
TCP
8118
—
proxy probe
proxy probe · port 8118 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8118
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 8118,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "562f26f4a23a0292834e76b9b5d831a20aebd821",
"event_fingerprint": "4ed816a53bd151192afd7e82854d1e33ccc4be5a",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 8118,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e74fa73e0151c3b8153b265dc53bf2bc19369be",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8118
},
"attack_vector": "proxy probe \u00b7 port 8118 \u00b7 (sonde \/ probe)",
"target_port_label": "8118",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8118
},
"attack_vector": "proxy probe \u00b7 port 8118 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8118",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:8118"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:20:19 UTC
TCP
8118 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8118 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
8118
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8118,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a147174bf7471c921e01565dfae717ddff1853c2",
"event_fingerprint": "96d4710af998f718df8c62f733ba73a96c278db8",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 8118,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa381537b6d412a6824f8ba13c41f05ed69086d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8118,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8118 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "8118 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8118,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8118 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "8118 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:8118"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:20:18 UTC
TCP
8118
—
proxy probe
proxy probe · port 8118 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8118
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 8118,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "64298ed0a71a95393808aff62f978972f14dfaaa",
"event_fingerprint": "4ed816a53bd151192afd7e82854d1e33ccc4be5a",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 8118,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "695f84acffe654c2675723740193752928fde944",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 8118
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 8118 \u00b7 (sonde \/ probe)",
"target_port_label": "8118",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 8118
},
"attack_vector": "proxy probe \u00b7 port 8118 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "8118",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:8118"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:19:46 UTC
TCP
8080 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
h /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_web_probe
Cible HTTP
h
/
TLS SNI
—
Capteur
paris-1
Méthode
h
Port
8080
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 20 · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
H / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "37198db21b7202e636438aa5da36611eb6d754de",
"event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"method": "\u0004\u0001\u0001h\u0010\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"method": "\u0004\u0001\u0001h\u0010\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f91a884baccfa30754bfd8db473a09b29634996e",
"protocol_details": {
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_path": "\/",
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_path": "\/",
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:19:46 UTC
TCP
8080 · HTTP
socks5 probe
socks5 probe · via HTTP:8080 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
/
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_web_probe
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
Méthode
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 42%
Confiance classification
50%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1 Signaux
pat-0567
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SOCKS5 greeting
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "37198db21b7202e636438aa5da36611eb6d754de",
"event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 50,
"precision_signals": [
"pat-0567"
],
"kb_rule_ids": [
"pat-0567"
],
"matched_patterns": [
"pat-0567"
],
"matched_pattern_names": [
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0567"
],
"confidence_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "950d0acc1be4155ce45759bb5f24cf456408cd94",
"protocol_details": {
"http_method": "\u0005\u0001\u0000",
"http_path": "\/",
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "socks5 probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567"
],
"tags_summary_labels_fr": [
"pat-0567"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0005\u0001\u0000",
"http_path": "\/",
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "socks5 probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:19:46 UTC
TCP
8080 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
8080
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "5272dd2322949be6d5bc33b0ad4d97aa4a0c03e0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a81c46569d7569ad2350d26fe72866350bfd3777",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:19:15 UTC
TCP
7890
—
proxy probe
proxy probe · port 7890 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7890
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 7890,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "32280e24bdb3fcfa976a8d71796ec19513fe6da2",
"event_fingerprint": "3b380ede597ca5d9d6f52aae5c18f6d3f0611403",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 7890,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64a3ea698f48561387628efe0460de8ceaba9966",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 7890
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 7890 \u00b7 (sonde \/ probe)",
"target_port_label": "7890",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 7890,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 7890
},
"attack_vector": "proxy probe \u00b7 port 7890 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "7890",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7890"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:19:15 UTC
TCP
7890
—
proxy probe
proxy probe · port 7890 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7890
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 7890,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc1f630e37c621f014fcdb2973c033f64edf2b31",
"event_fingerprint": "3b380ede597ca5d9d6f52aae5c18f6d3f0611403",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 7890,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66f4af0ffc8693e62a22c2f08bc504f4f5025f39",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 7890
},
"attack_vector": "proxy probe \u00b7 port 7890 \u00b7 (sonde \/ probe)",
"target_port_label": "7890",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 7890,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 7890
},
"attack_vector": "proxy probe \u00b7 port 7890 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7890",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7890"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:19:15 UTC
TCP
7890 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:7890 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
7890
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 7890,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "39414bf0d63074f979c96f856e66222feeb6e1bf",
"event_fingerprint": "e0ee8452408732d58ac7cb000d5531cd04413818",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 7890,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57bec7d55f9317d6e7b129b55f0c06489f77fdff",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 7890,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7890 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "7890 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7890,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 7890,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7890 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "7890 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7890"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:7890",
"port:999"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
14/07/2026 00:14:56 UTC
TCP
999
—
proxy probe
proxy probe · port 999 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
999
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 999,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5f7a6e8d5d52e6b6a13e6dc970ce50552c948628",
"event_fingerprint": "501c22580bbf62cbda2aff2e4e7d73f26235398a",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 999,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86c51388cd001f74884d93db5def4107c5802110",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 999
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)",
"target_port_label": "999",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 999,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 999
},
"attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "999",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:999",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:14:56 UTC
TCP
999
—
proxy probe
proxy probe · port 999 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
999
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 999,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ce10e7554571973b0432369d9b8c4624f360620d",
"event_fingerprint": "501c22580bbf62cbda2aff2e4e7d73f26235398a",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 999,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1075b36284a2a6701e9feb2e2e993605c59171f3",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 999
},
"attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)",
"target_port_label": "999",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 999,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 999
},
"attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "999",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:999",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:14:56 UTC
TCP
999 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:999 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
999
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 999,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b5fc4dd518fc5193a207f5bd279a2d94ccb751ca",
"event_fingerprint": "3cc6375087caa33ec5a8fa6f57a6b24bfa819a8e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 999,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dcc05919cef125d9d1b06e8f69975191248b600b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:999 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 999,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:999 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:999",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
14/07/2026 00:11:44 UTC
TCP
8888 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8888 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
h /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_web_probe
Cible HTTP
h
/
TLS SNI
—
Capteur
paris-1
Méthode
h
Port
8888
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 35%
Confiance classification
43%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 35 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1 Signaux
pat-0599
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
H / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dfa46546398853b0aacdc51e36958ab2ee94c072",
"event_fingerprint": "49f507c2cf48f6931b95b26ad1848f202640d676",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 35%",
"confidence": 0.43,
"classification_confidence": 0.43,
"precision_score": 42,
"precision_signals": [
"pat-0599"
],
"kb_rule_ids": [
"pat-0599"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 35,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"method": "\u0004\u0001\u0001h\u0010\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"method": "\u0004\u0001\u0001h\u0010\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 35%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97e7ec1467a13b701b196459e693f5361c270234",
"protocol_details": {
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_path": "\/",
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 35%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 35%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 43,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"pat-0599"
],
"tags_summary_labels_fr": [
"pat-0599"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0004\u0001\u0001h\u0010\u0000",
"http_path": "\/",
"request_line": "\u0004\u0001\u0001H\u0010\u0000 \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 43 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:11:44 UTC
TCP
8888 · HTTP
socks5 probe
socks5 probe · via HTTP:8888 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
/
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_web_probe
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
Méthode
Port
8888
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 42%
Confiance classification
50%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1 Signaux
pat-0567
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SOCKS5 greeting
HTTP alt 8888 probe
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dfa46546398853b0aacdc51e36958ab2ee94c072",
"event_fingerprint": "49f507c2cf48f6931b95b26ad1848f202640d676",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 50,
"precision_signals": [
"pat-0567"
],
"kb_rule_ids": [
"pat-0567"
],
"matched_patterns": [
"pat-0567",
"pat-0599"
],
"matched_pattern_names": [
"SOCKS5 greeting",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0567",
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f76b70908a1e4d63c77b9643f0f1da1c93e25d22",
"protocol_details": {
"http_method": "\u0005\u0001\u0000",
"http_path": "\/",
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "socks5 probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 20,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"pat-0567"
],
"tags_summary_labels_fr": [
"pat-0567"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0005\u0001\u0000",
"http_path": "\/",
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "socks5 probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:11:44 UTC
TCP
8888 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8888 · (sonde / probe) · → 104.16.184.241:443
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
8888
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 35%
Confiance classification
43%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 35 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0599
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 8888,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "41b5c0b9b6596925c153a6619ccc889c46ec0842",
"event_fingerprint": "bc8c4cff4ddd855e44d4a8a1f2a5b893ed8fe603",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%",
"confidence": 0.43,
"classification_confidence": 0.43,
"precision_score": 42,
"precision_signals": [
"pat-0599"
],
"kb_rule_ids": [
"pat-0599"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 35,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21dfc15a45d6f8a3bcada1adba7525970dce62fb",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 35%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 43,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"pat-0599"
],
"tags_summary_labels_fr": [
"pat-0599"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 35 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 43 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
14/07/2026 00:11:30 UTC
TCP
3629 · SAP Message Server
Sonde SAP Message Server
sap message server · via SAP Message Server:3629 · (sonde / probe)
Élevée
Faible · 23
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-MS
WAF
—
Recommandation
Surveiller
Tags
net_sap_message_server
sap_message_server
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3629
Chemin / cible
—
Service
SAP Message Server
Payload
�h��
Pourquoi cette classification : Type « sap_message_server » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 23
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "sap-ms",
"app_proto": "sap-ms",
"asn": 48090,
"country": "BG",
"dst_port": 3629,
"risk_waf": 8,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 23,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7fb328521322a2428e7fa3ed6413b54f73bc8c31",
"event_fingerprint": "debce5589d366b9fbd43bc79b7914364516ae98f",
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 23,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "sap-ms",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "2138b680d49e609f193d6f5ce29c915a"
},
"target_context": {
"dst_port": 3629,
"service": "sap-ms",
"service_name": "sap-ms",
"risk_score": 23
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "626647965e9511854d1799c2aacdc1987f6197c3",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 3629,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "sap message server \u00b7 via SAP Message Server:3629 \u00b7 (sonde \/ probe)",
"target_port_label": "3629 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 23,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 23,
"risk_label": "Faible",
"service_name": "sap-ms",
"service_label_fr": "SAP Message Server",
"dst_port": 3629,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-ms",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 3629,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"attack_vector": "sap message server \u00b7 via SAP Message Server:3629 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "3629 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_ms",
"service_banner": "honeypot-sap-ms",
"service_os": "linux",
"dst_port": "3629"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_message_server",
"sap_message_server",
"socks4_greeting"
]
}
14/07/2026 00:11:30 UTC
TCP
3629 · SAP Message Server
Sonde SAP Message Server
sap message server · via SAP Message Server:3629 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-MS
WAF
—
Recommandation
Surveiller
Tags
net_sap_message_server
sap_message_server
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3629
Chemin / cible
—
Service
SAP Message Server
Payload
Pourquoi cette classification : Type « sap_message_server » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 34
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "sap-ms",
"app_proto": "sap-ms",
"asn": 48090,
"country": "BG",
"dst_port": 3629,
"risk_waf": 8,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "89f4eaee7398dd6a7f044e177b1ee85599ef158b",
"event_fingerprint": "debce5589d366b9fbd43bc79b7914364516ae98f",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 8
},
"service_name": "sap-ms",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "2138b680d49e609f193d6f5ce29c915a"
},
"target_context": {
"dst_port": 3629,
"service": "sap-ms",
"service_name": "sap-ms",
"risk_score": 34
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92a0605931394e44c8087a16b78a5172e9369126",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3629,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"attack_vector": "sap message server \u00b7 via SAP Message Server:3629 \u00b7 (sonde \/ probe)",
"target_port_label": "3629 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab sap_message_server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-ms",
"service_label_fr": "SAP Message Server",
"dst_port": 3629,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-ms",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3629,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"attack_vector": "sap message server \u00b7 via SAP Message Server:3629 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3629 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_ms",
"service_banner": "honeypot-sap-ms",
"service_os": "linux",
"dst_port": "3629"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_message_server",
"sap_message_server",
"socks5_greeting"
]
}
14/07/2026 00:11:30 UTC
TCP
3629 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:3629 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
3629
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 3629,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b9376ce06a9b33fb3f5255f5ecd565328f50ba13",
"event_fingerprint": "bec7cc49e01c3775b17ee2db8ea00bea4095ac54",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 3629,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c80d1403f5eee5e03fc821bce56f405d2ce7b6bc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 3629,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3629 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "3629 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3629,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 3629,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3629 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "3629 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3629"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:4153",
"sap-ms",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:09:41 UTC
TCP
3128 · SQUID
Sonde Squid proxy
squid probe · via SQUID:3128 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SQUID
WAF
—
Recommandation
Surveiller
Tags
net_squid_probe
socks4_greeting
squid_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3128
Chemin / cible
—
Service
SQUID
Payload
�h��
Pourquoi cette classification : Type « squid_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e31203430372050726f78792041757468656e7469636174696f6e2052657175697265640d0a50726f78792d41757468656e7469636174653a204261736963207265616c6d3d227371756964220d0a436f6e74656e742d4c656e6774683a2034360d0a0d0a3c68746d6c3e3c626f64793e53717569642070726f",
"emulator_response_len": 153,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "squid",
"app_proto": "squid",
"asn": 48090,
"country": "BG",
"dst_port": 3128,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f9ef99c1a01f99cbedd0a0f7f0098c1011eadafc",
"event_fingerprint": "81586bffa6e86d9c12ce9b39f0f0b836967cb06f",
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "squid",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "9e572cafeeabbd95104cd808285e515e"
},
"target_context": {
"dst_port": 3128,
"service": "squid",
"service_name": "squid",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b9a9c058fbe866ad71be6d6bc595b11dbbab98f4",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)",
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "squid",
"service_label_fr": "SQUID",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-squid",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "squid",
"service_banner": "honeypot-squid",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:4153",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_squid_probe",
"socks4_greeting",
"squid_emulated"
]
}
14/07/2026 00:09:41 UTC
TCP
3128 · SQUID
Sonde Squid proxy
squid probe · via SQUID:3128 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SQUID
WAF
—
Recommandation
Surveiller
Tags
net_squid_probe
socks5_greeting
squid_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3128
Chemin / cible
—
Pourquoi cette classification : Type « squid_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e31203430372050726f78792041757468656e7469636174696f6e2052657175697265640d0a50726f78792d41757468656e7469636174653a204261736963207265616c6d3d227371756964220d0a436f6e74656e742d4c656e6774683a2034360d0a0d0a3c68746d6c3e3c626f64793e53717569642070726f",
"emulator_response_len": 153,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "squid",
"app_proto": "squid",
"asn": 48090,
"country": "BG",
"dst_port": 3128,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d6b0c1ec22e6e5cd57badbc9e189c4f34a0f6083",
"event_fingerprint": "81586bffa6e86d9c12ce9b39f0f0b836967cb06f",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "squid",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "9e572cafeeabbd95104cd808285e515e"
},
"target_context": {
"dst_port": 3128,
"service": "squid",
"service_name": "squid",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ddac4adc01311a54bf0844f3058be4c4596ece1c",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)",
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "squid",
"service_label_fr": "SQUID",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-squid",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "squid",
"service_banner": "honeypot-squid",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:4153",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_squid_probe",
"socks5_greeting",
"squid_emulated"
]
}
14/07/2026 00:09:41 UTC
TCP
3128 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
3128
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 3128,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "727b94996eef191c4ca938096611397d640aa6b6",
"event_fingerprint": "bf7a5e9f487fb7eedfcdeeb6cc543d3a1ca2e01f",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4dd87e59c38ae067fe043bbf51b39f6c4868d29f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:4153",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
14/07/2026 00:07:26 UTC
TCP
4153
—
proxy probe
proxy probe · port 4153 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4153
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 4153,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b141f5e0c06f01c0f4bca7a60839ae48dd10d3cc",
"event_fingerprint": "41794b88e734e886ed08a00414954ac84077d62b",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 4153,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2785e281ece5947af4f78940a4e4114e7757001",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 4153
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
"target_port_label": "4153",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 4153,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 4153
},
"attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "4153",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4153"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:4153"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:07:26 UTC
TCP
4153
—
proxy probe
proxy probe · port 4153 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4153
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 4153,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "468f125ac3a52406bb24d0652d79396d01719582",
"event_fingerprint": "41794b88e734e886ed08a00414954ac84077d62b",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 4153,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fee74f1808338641838b871de2c8202e7c678c9e",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 4153
},
"attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
"target_port_label": "4153",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 4153,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 4153
},
"attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4153",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4153"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:4153"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:07:26 UTC
TCP
4153 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:4153 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
4153
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 4153,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8e1608b3fcc5c5f1d5b76a7a91a700a05b56d4d2",
"event_fingerprint": "85ca2aca3f308c6d54ae47bf33c0898c023e3205",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 4153,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d9f8d95f1684a4776aea4da3466a0984b3bb6e0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 4153,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4153 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "4153 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4153,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 4153,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4153 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "4153 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4153"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:4153"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:05:45 UTC
TCP
10800
—
proxy probe
proxy probe · port 10800 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10800
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 10800,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "5e702ef46afd1dd05b61e1f55c96f84e4ab4a564",
"event_fingerprint": "a988aa990595fe22652649c7d7377de57f356c7a",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 10800,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb8197b159e2f61d54f28e716b1294276c59a22a",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 10800
},
"attack_vector": "proxy probe \u00b7 port 10800 \u00b7 (sonde \/ probe)",
"target_port_label": "10800",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 10800,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 10800
},
"attack_vector": "proxy probe \u00b7 port 10800 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "10800",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:05:45 UTC
TCP
10800 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10800 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
10800
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 10800,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "25be3e75e40ff16d372a1347d183e698152266af",
"event_fingerprint": "ddf11e345e9538516bbc9c4f9222c82d9e6aacf2",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 10800,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d28af58337030548d3ff37165bb1bc3e3c5cc06",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 10800,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10800 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "10800 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10800,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 10800,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10800 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "10800 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:05:44 UTC
TCP
10800
—
proxy probe
proxy probe · port 10800 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10800
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 10800,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f87df602fdb129a8f2b94c9db80bb69c43834c0b",
"event_fingerprint": "a988aa990595fe22652649c7d7377de57f356c7a",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 10800,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "884dd95d9df391652b0b6ce337f4e08c33b1e7a3",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 10800
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 10800 \u00b7 (sonde \/ probe)",
"target_port_label": "10800",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 10800,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 10800
},
"attack_vector": "proxy probe \u00b7 port 10800 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "10800",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10800"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10800",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:03:57 UTC
TCP
1111
—
proxy probe
proxy probe · port 1111 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1111
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 1111,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "2d31dd4d63b76febcff6bcc29aa1d2b8b2cfc7dd",
"event_fingerprint": "60de1ef7adb932d6b4e449540e5e8e8f0c32cc98",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1111,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f58ad889fa6905c3bb21a8721efd2980afb145b5",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 1111
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 1111 \u00b7 (sonde \/ probe)",
"target_port_label": "1111",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1111,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 1111
},
"attack_vector": "proxy probe \u00b7 port 1111 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "1111",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:1082",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:03:57 UTC
TCP
1111
—
proxy probe
proxy probe · port 1111 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1111
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 1111,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "38dbb364853a9bd50e23f45700e1815364892629",
"event_fingerprint": "60de1ef7adb932d6b4e449540e5e8e8f0c32cc98",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1111,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af95f2be34b92df12afc0109fe43b807a0799ffb",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1111
},
"attack_vector": "proxy probe \u00b7 port 1111 \u00b7 (sonde \/ probe)",
"target_port_label": "1111",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1111,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1111
},
"attack_vector": "proxy probe \u00b7 port 1111 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1111",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:1082",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
14/07/2026 00:03:57 UTC
TCP
1111 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1111 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
1111
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 1111,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "34b02523f98872897689ee55756bf0d52fa4364d",
"event_fingerprint": "f6294be859fea4fdd51611dec8144f3c22dad0e0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 1111,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f39d2348ba7ad160bfbb80d04d2c3e4cf6febac9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 1111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "1111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1111,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 1111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "1111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:1082",
"port:1111",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:01:52 UTC
TCP
5678 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5678 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
5678
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7a25de3143e01a6f0a82cd6403d9157bbef5d2e2",
"event_fingerprint": "2d9fbc394efdb4a2fda28aac4a006a8a2e5abd63",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 5678,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a07695b81c1d9b59e1e9a8c555413aa7acac194d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5678 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 5678,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5678 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "5678 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1082",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
14/07/2026 00:01:51 UTC
TCP
5678
—
proxy probe
proxy probe · port 5678 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5678
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "459532e3cdf4dac3d397d0bb96bc1e7083570eeb",
"event_fingerprint": "0af24311fcbe1dc8fcdfadcb2cf8d336c8778459",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 5678,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76eaf0019f5797783c891f008a048ed4121c7cac",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 5678
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 5678 \u00b7 (sonde \/ probe)",
"target_port_label": "5678",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 5678
},
"attack_vector": "proxy probe \u00b7 port 5678 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "5678",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1082",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
14/07/2026 00:01:51 UTC
TCP
5678
—
proxy probe
proxy probe · port 5678 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5678
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 5678,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d8010da30661100ee23a585c879fb55844a263a2",
"event_fingerprint": "0af24311fcbe1dc8fcdfadcb2cf8d336c8778459",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 5678,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96190d65126f85b67459e82e8b9d126aa3bde0c1",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5678
},
"attack_vector": "proxy probe \u00b7 port 5678 \u00b7 (sonde \/ probe)",
"target_port_label": "5678",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5678,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5678
},
"attack_vector": "proxy probe \u00b7 port 5678 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5678",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5678"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:1082",
"port:5678"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
13/07/2026 23:59:57 UTC
TCP
1082
—
proxy probe
proxy probe · port 1082 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1082
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 1082,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "942d3decbafffcb8ee97927122aee75502334319",
"event_fingerprint": "e9f5f09f3c579a5a3cb23c64bca8a57673dfd747",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5eca8780b9a68f9541c0bdf5a2c5a2e",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1082,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4378bc767dd8143f2657017361c499b3c405892",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 1082
},
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"attack_vector": "proxy probe \u00b7 port 1082 \u00b7 (sonde \/ probe)",
"target_port_label": "1082",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1082,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0010\ufffd\ufffd\u0000",
"port": 1082
},
"attack_vector": "proxy probe \u00b7 port 1082 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh\ufffd\ufffd",
"target_port_label": "1082",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
13/07/2026 23:59:57 UTC
TCP
1082
—
proxy probe
proxy probe · port 1082 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1082
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": null,
"app_proto": null,
"asn": 48090,
"country": "BG",
"dst_port": 1082,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1166a7abc43cebae5981891a964720b57f908295",
"event_fingerprint": "e9f5f09f3c579a5a3cb23c64bca8a57673dfd747",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1082,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d96a8edbf02b6da16a473163b4fddfa279c58140",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1082
},
"attack_vector": "proxy probe \u00b7 port 1082 \u00b7 (sonde \/ probe)",
"target_port_label": "1082",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1082,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1082
},
"attack_vector": "proxy probe \u00b7 port 1082 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1082",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
13/07/2026 23:59:57 UTC
TCP
1082 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1082 · (sonde / probe) · → 104.16.184.241:443
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 104.16.184.241:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
104.16.184.241:443
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
1082
Chemin / cible
104.16.184.241:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 104.16.184.241:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 104.16.184.241:443 HTTP/1.1
Host: 104.16.184.241:443
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "241:443",
"http_ua_hash": null,
"http_host_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_target_hash": "f3f4346427d0b80720cbd17384b5ebdf9f188293",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 65,
"payload_entropy": 4.085991138213565,
"port_category": "registered",
"org": "Techoff Srv Limited",
"service": "http",
"app_proto": "http",
"asn": 48090,
"country": "BG",
"dst_port": 1082,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "70f0b693b77ee83308220ac0cdb4f812ba971838",
"event_fingerprint": "74e8466a5e9cee987c23b9a02d13f0e130504e37",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6aa58fb50600026d17199c2c67598748",
"path_pattern_hash": "cd6fea401f161fb66ec64bdbc07eda5a"
},
"service_name": "http",
"target_context": {
"dst_port": 1082,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"evidence": {
"method": "CONNECT",
"path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"request_sample": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443\r\n\r\n",
"payload_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8bbd2a46edd25b141a95b2316c01697737029cc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 1082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1082 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"target_port_label": "1082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1082,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "104.16.184.241:443",
"request_line": "CONNECT 104.16.184.241:443 HTTP\/1.1",
"port": 1082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1082 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.16.184.241:443",
"evidence_snippet": "CONNECT 104.16.184.241:443 HTTP\/1.1\r\nHost: 104.16.184.241:443",
"target_port_label": "1082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1082"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
13/07/2026 16:46:28 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \7���N����<��W�4 `mlkem768x25519-sha256,curv…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \7���N����<��W�4 `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nis…
Payload
SSH-2.0-Go \7���N����<��W�4 `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\7���N����<��W�4 `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \7���N����<��W�4 `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.901191905555072,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9ad197e8096b24c160d21a9eae9e65e8",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41f793696b28c00681773b849fd972854247d767",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\7\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00147\ufffd\ufffd\ufffd\u0003N\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\7\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffdW\ufffd4`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 16:34:21 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \0�ė���Ţ����r; `mlkem768x25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \0�ė���Ţ����r; `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp…
Payload
SSH-2.0-Go \0�ė���Ţ����r; `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\0�ė���Ţ����r; `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \0�ė���Ţ����r; `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1388,
"payload_entropy": 4.900396915112976,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "15590e587f1dadf2b03f1dc30707fbe2",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31690d5859c244d111932c2bb6351c6ddaec186a",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\0\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00140\u0002\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\0\ufffd\u0117\ufffd\ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdr;`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 16:20:16 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \���t�=�ЫY�����k `mlkem768x25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \���t�=�ЫY�����k `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nist…
Payload
SSH-2.0-Go \���t�=�ЫY�����k `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\���t�=�ЫY�����k `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \���t�=�ЫY�����k `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1388,
"payload_entropy": 4.901987584493393,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d3d510c9dae405f01d40eec85d0c9a3",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7600b48033ff7a675a697f9debd503571a777a62",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffdt\ufffd=\ufffd\u042bY\ufffd\ufffd\ufffd\ufffd\ufffdk`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 16:08:23 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \KdT�Y6 �j�A� `mlkem768x25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \KdT�Y6 �j�A� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nist…
Payload
SSH-2.0-Go \KdT�Y6 �j�A� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\KdT�Y6 �j�A� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \KdT�Y6 �j�A� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1388,
"payload_entropy": 4.900082491389355,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e31b1deeb0e40ede9b8601cc4a8f3bc5",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9a16a69b042d5fa4ec7b25c6f1716ecf1d04cc9",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\KdT\ufffdY6 \ufffdj\ufffdA\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Kd\u001aT\ufffdY6 \u0004\u0017\ufffdj\ufffdA\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\KdT\ufffdY6 \ufffdj\ufffdA\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 15:56:09 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \���q�RV��("��K� `mlkem768x25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \���q�RV��("��K� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nist…
Payload
SSH-2.0-Go \���q�RV��("��K� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\���q�RV��("��K� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \���q�RV��("��K� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.909252641462781,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9a8915bcc6a81215428f3c5e2d237366",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "405f1d3973514bbdb302171e3ecbc9ceb4674114",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffdq\ufffdRV\ufffd\ufffd(\"\ufffd\ufffdK\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 15:41:55 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \-� Z�qB�� �F� `mlkem768x25519-sha256,curv…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \-� Z�qB�� �F� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nis…
Payload
SSH-2.0-Go \-� Z�qB�� �F� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\-� Z�qB�� �F�
`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \-� Z�qB�� �F� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.898575956847851,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04322c4e215298ab54c378af425727ee",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0095cbd86b1cd23c4cdc32ccd130956d984ffcdb",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\-\ufffdZ\ufffdqB\ufffd\ufffd\ufffdF\ufffd\n`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014-\ufffd\u001eZ\ufffdqB\ufffd\ufffd\u0000\ufffdF\ufffd\n\u0016\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\-\ufffdZ\ufffdqB\ufffd\ufffd\ufffdF\ufffd\n`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 15:29:51 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \It�7L-�d�=�� 9� `mlkem768x25519-sha256,curv…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \It�7L-�d�=�� 9� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nis…
Payload
SSH-2.0-Go \It�7L-�d�=�� 9� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\It�7L-�d�=�� 9� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \It�7L-�d�=�� 9� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1388,
"payload_entropy": 4.8872388739954395,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d3992bef3eb695dee9d24d21278500a",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7975a13df4dbb95dbc51e13bfa8bc50fdd561502",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\It\ufffd7L-\ufffdd\ufffd=\ufffd\ufffd9\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014It\ufffd7L-\ufffdd\ufffd=\ufffd\u000f\ufffd\u001c9\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\It\ufffd7L-\ufffdd\ufffd=\ufffd\ufffd9\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 15:17:33 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \���`��H"�i�*n��� `mlkem768x25519-sha256,curv…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \���`��H"�i�*n��� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nis…
Payload
SSH-2.0-Go \���`��H"�i�*n��� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\���`��H"�i�*n��� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \���`��H"�i�*n��� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.883307946176113,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b677d9f58196a6aa6991491cbd8031be",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4ad27c49b0f32c2eb9dc04b019ee71ef215fa51",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffd\ufffd\ufffd`\ufffd\ufffdH\"\ufffdi\ufffd*n\ufffd\ufffd\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 15:05:09 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \NW�\�Z�Mn `mlkem768x25519-sha256,curve255…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \NW�\�Z�Mn `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp25…
Payload
SSH-2.0-Go \NW�\�Z�Mn `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\NW�\�Z�Mn `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \NW�\�Z�Mn `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.907253060891792,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5befa7bcd99aaea75c9776325041f788",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce8cf5c9ac4a7654e4c643754f15c537ee77aafb",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\NW\ufffd\\\ufffd\ud93c\udf37Z\ufffdMn`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014NW\ufffd\\\ufffd\ud93c\udf37\bZ\ufffdMn\u0014\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\NW\ufffd\\\ufffd\ud93c\udf37Z\ufffdMn`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 14:52:46 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \뇢}�:� y�"E�Z`� `mlkem768x25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \뇢}�:� y�"E�Z`� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp…
Payload
SSH-2.0-Go \뇢}�:� y�"E�Z`� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\뇢}�:�
y�"E�Z`� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \뇢}�:� y�"E�Z`� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.897297724231375,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2fc8ae6f0149f0011fc2d6c0c69a23e6",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bef4979b7bf92069715c6845899ae8ae5b852f3a",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\\ub1e2}\ufffd:\ufffd\ny\ufffd\"E\ufffdZ`\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 14:40:08 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \�A�����;�m!ؑSi `mlkem768x25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \�A�����;�m!ؑSi `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nist…
Payload
SSH-2.0-Go \�A�����;�m!ؑSi `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\�A�����;�m!ؑSi `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \�A�����;�m!ؑSi `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1388,
"payload_entropy": 4.894679048885802,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "03d6f57c001c0369746452514d543e6f",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f1a0ce1aa5e6ef72b32d3c347e18c04f7f39f861",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si\u0011\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffdm!\u0611Si`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 14:27:37 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \)Gv�h�|��\S�x�u `mlkem768x25519-sha256,curv…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \)Gv�h�|��\S�x�u `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nis…
Payload
SSH-2.0-Go \)Gv�h�|��\S�x�u `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\)Gv�h�|��\S�x�u `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \)Gv�h�|��\S�x�u `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.884436757648002,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c4642b649b4f5152567d71488de26064",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2efa4c4bd6f2a97e4b09ea22bad52841d9fb2d68",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\)Gv\ufffdh\ufffd|\ufffd\ufffd\\S\ufffdx\ufffdu`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014)Gv\ufffdh\ufffd|\u0012\ufffd\ufffd\\S\ufffdx\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\)Gv\ufffdh\ufffd|\ufffd\ufffd\\S\ufffdx\ufffdu`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
13/07/2026 14:15:02 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-Go \+�ڳġKM � B�q� `mlkem768x25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go \+�ڳġKM � B�q� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp2…
Payload
SSH-2.0-Go \+�ڳġKM � B�q� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
\+�ڳġKM �
B�q� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec
Requête brute (extrait)
SSH-2.0-Go \+�ڳġKM � B�q� `mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1388,
"payload_entropy": 4.907366051567733,
"port_category": "well_known",
"org": "Techoff Srv Limited",
"service": "ssh",
"app_proto": "ssh",
"asn": 48090,
"country": "BG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 48090,
"org": "Techoff Srv Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afa3072634e11088f4006441e4b37433",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"evidence": {
"request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sh",
"payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b125d830c5e21d2535e2b14bd9aa8f5c39ff7ec",
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-Go\r\n\\+\ufffd\u06b3\u0121KM\ufffd\rB\ufffdq\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014+\ufffd\u06b3\u0121KM\f\ufffd\rB\ufffdq\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-Go\r\n\\+\ufffd\u06b3\u0121KM\ufffd\rB\ufffdq\ufffd`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}