|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde PostgreSQL
postgresql probe · via POSTGRES:5432 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Handshake PostgreSQL (startup)
Émulateur
POSTGRES
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "postgres",
"app_proto": "postgres",
"asn": 211298,
"country": "GB",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "272205ffb91c9631a06988b863bb09a8579d4d67",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c2f90aff0214642f91857fa890d68e267a73363",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "postgres",
"service_label_fr": "POSTGRES",
"dst_port": 5432,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "PostgreSQL 15.4",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde PostgreSQL
postgresql probe · via POSTGRES:5432 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Handshake PostgreSQL (startup)
Émulateur
POSTGRES
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_emulated
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Service
POSTGRES
Payload
yh�`��
Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 3.169925001442312,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "postgres",
"app_proto": "postgres",
"asn": 211298,
"country": "GB",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7f1a00084ed60a361fd3c7b24e2fceca97122025",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dd768d7638d9485a436cae4c61ab3f7a",
"path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 34
},
"payload_preview": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"request_sample": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"payload_snippet": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07941b1c594460ef728b4d23f27bc9701e7f542b",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"evidence_snippet": "yh\ufffd`\ufffd\ufffd",
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "postgres",
"service_label_fr": "POSTGRES",
"dst_port": 5432,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "PostgreSQL 15.4",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "\u0004\u0001yh\ufffd`\ufffd\ufffd\u0000",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"evidence_snippet": "yh\ufffd`\ufffd\ufffd",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_emulated",
"socks4_greeting"
]
}
|
|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde PostgreSQL
postgresql probe · via POSTGRES:5432 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Handshake PostgreSQL (startup)
Émulateur
POSTGRES
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "postgres",
"app_proto": "postgres",
"asn": 211298,
"country": "GB",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "272205ffb91c9631a06988b863bb09a8579d4d67",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c2f90aff0214642f91857fa890d68e267a73363",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "postgres",
"service_label_fr": "POSTGRES",
"dst_port": 5432,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "PostgreSQL 15.4",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_emulated"
]
}
|
|
|
TCP |
2107 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:2107 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 838891941d5e2238 SNI api.blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
api.blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
2107
Chemin / cible
—
Service
TLS
SNI TLS
api.blacklistip.com
Payload
� �+��Q�(� !چ_�^j�{��Ȏm>�)��4��g b�/� ���J�*�+���+ae�n��ωާ�H 6�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+��Q�(�
!چ_�^j�{��Ȏm>�)��4��g b�/� ���J�*�+���+ae�n��ωާ�H 6�+�/�,�0̨̩� ��
� � � / 5��
�$�(�#�' < =��
Requête brute (extrait)
� �+��Q�(� !چ_�^j�{��Ȏm>�)��4��g b�/� ���J�*�+���+ae�n��ωާ�H 6�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =�� q api.blacklistip.com � +
Meta JSON brut
{
"tls_ja3_hash": "838891941d5e22381ce009aa7cca9d11",
"tls_sni": "api.blacklistip.com",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"bytes_in": 249,
"payload_entropy": 5.566393022123371,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 211298,
"country": "GB",
"dst_port": 2107,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f634b632794847cc50784310138c8ea34fa1ab96",
"event_fingerprint": "d23fe4139bdae58b70442f989643780d182817e0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "838891941d5e22381ce009aa7cca9d11",
"payload_hash": "801640ac2979e40cfd508b39d80b5428",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e912aab38ca9e8c456c441f9ab094cfe",
"tls_version": "0x0303",
"tls_cipher_count": 27,
"tls_sni": "api.blacklistip.com",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4,0-5-10-11-13-65281-23-18-43,29-23-24-25,0",
"tls_ja4_hash": "e912aab38ca9e8c456c441f9ab094cfe",
"tls_ja4": "t13i0127_c64e120eaefc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 27,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2107,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em\u0003>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd\u0001+ae\ufffdn\b\ufffd\ufffd\u03c9\u07a7\ufffdH\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em\u0003>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd\u0001+ae\ufffdn\b\ufffd\ufffd\u03c9\u07a7\ufffdH\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0001\u0000\u0000q\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013api.blacklistip.com\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em\u0003>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd\u0001+ae\ufffdn\b\ufffd\ufffd\u03c9\u07a7\ufffdH\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32966e25cbb65dde32ee9815815bb74a439ed62f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em\u0003>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd\u0001+ae\ufffdn\b\ufffd\ufffd\u03c9\u07a7\ufffdH\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"tls_ja3": "838891941d5e22381ce009aa7cca9d11",
"tls_ja4": "e912aab38ca9e8c456c441f9ab094cfe",
"tls_sni": "api.blacklistip.com",
"port": 2107,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd+ae\ufffdn\ufffd\ufffd\u03c9\u07a7\ufffdH6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:2107 \u00b7 (sonde \/ probe)",
"target_port_label": "2107 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2107,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em\u0003>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\u001e\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd\u0001+ae\ufffdn\b\ufffd\ufffd\u03c9\u07a7\ufffdH\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"tls_ja3": "838891941d5e22381ce009aa7cca9d11",
"tls_ja4": "e912aab38ca9e8c456c441f9ab094cfe",
"tls_sni": "api.blacklistip.com",
"port": 2107,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:2107 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdQ\ufffd(\ufffd\n!\u0686_\ufffd^j\ufffd{\ufffd\ufffd\u020em>\ufffd)\ufffd\ufffd4\ufffd\ufffdg b\ufffd\/\ufffd\ufffd\ufffd\ufffdJ\ufffd*\ufffd+\ufffd\ufffd\ufffd+ae\ufffdn\ufffd\ufffd\u03c9\u07a7\ufffdH6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"target_port_label": "2107 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2107"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
2107 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:2107 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 26086471650ff2ae SNI api.blacklistip.com
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_weak_cipher
Cible HTTP
—
TLS SNI
api.blacklistip.com
Capteur
paris-1
|
Méthode
—
Port
2107
Chemin / cible
—
Service
TLS
SNI TLS
api.blacklistip.com
Payload
& ".{����x���dx���4q��[�#En��k2 � ��i���^h�f<]� ��)N3�ѦX�l�� <�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
& ".{����x���dx���4q��[�#En��k2 � ��i���^h�f<]� ��)N3�ѦX�l�� <�+�/�,�0̨̩� ��
� � � / 5��
�$�(�#�' < =��
Requête brute (extrait)
& ".{����x���dx���4q��[�#En��k2 � ��i���^h�f<]� ��)N3�ѦX�l�� <�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =�� � api.blacklistip.com � +
Meta JSON brut
{
"tls_ja3_hash": "26086471650ff2aef650d748b8b581b4",
"tls_sni": "api.blacklistip.com",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"bytes_in": 299,
"payload_entropy": 5.815434150873056,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 211298,
"country": "GB",
"dst_port": 2107,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f634b632794847cc50784310138c8ea34fa1ab96",
"event_fingerprint": "8c417fde20345420b5d14a2f7a4a33e799dd3fd0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "26086471650ff2aef650d748b8b581b4",
"payload_hash": "bd8f8f072e8a86f9cab4487f695ecc8f",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"tls_sni": "api.blacklistip.com"
},
"target_context": {
"dst_port": 2107,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003.{\ufffd\b\ufffd\u0019\ufffd\ufffdx\ufffd\ufffd\u0014\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2\u001b \ufffd\u0000\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\u0000\ufffd\ufffd)\u0002N3\ufffd\u001b\u0466X\ufffdl\ufffd\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003.{\ufffd\b\ufffd\u0019\ufffd\ufffdx\ufffd\ufffd\u0014\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2\u001b \ufffd\u0000\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\u0000\ufffd\ufffd)\u0002N3\ufffd\u001b\u0466X\ufffdl\ufffd\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013api.blacklistip.com\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003.{\ufffd\b\ufffd\u0019\ufffd\ufffdx\ufffd\ufffd\u0014\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2\u001b \ufffd\u0000\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\u0000\ufffd\ufffd)\u0002N3\ufffd\u001b\u0466X\ufffdl\ufffd\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c2bb72028806d113eb6116d601df85141283a0a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003.{\ufffd\b\ufffd\u0019\ufffd\ufffdx\ufffd\ufffd\u0014\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2\u001b \ufffd\u0000\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\u0000\ufffd\ufffd)\u0002N3\ufffd\u001b\u0466X\ufffdl\ufffd\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"tls_ja3": "26086471650ff2aef650d748b8b581b4",
"tls_sni": "api.blacklistip.com",
"port": 2107,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "&\".{\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2 \ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\ufffd\ufffd)N3\ufffd\u0466X\ufffdl\ufffd\ufffd<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:2107 \u00b7 (sonde \/ probe)",
"target_port_label": "2107 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2107,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003.{\ufffd\b\ufffd\u0019\ufffd\ufffdx\ufffd\ufffd\u0014\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2\u001b \ufffd\u0000\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\u0000\ufffd\ufffd)\u0002N3\ufffd\u001b\u0466X\ufffdl\ufffd\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"tls_ja3": "26086471650ff2aef650d748b8b581b4",
"tls_sni": "api.blacklistip.com",
"port": 2107,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:2107 \u00b7 (sonde \/ probe)",
"evidence_snippet": "&\".{\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffddx\ufffd\ufffd\ufffd4q\ufffd\ufffd[\ufffd#En\ufffd\ufffdk2 \ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd^h\ufffdf<]\ufffd\ufffd\ufffd)N3\ufffd\u0466X\ufffdl\ufffd\ufffd<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"target_port_label": "2107 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2107"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5005 · RTCP
|
rtcp
|
Protocole TDS MSSQL
mssql tds · via RTCP:5005 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RTCP
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5005
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74207274637020726561647920706f72743d353030350d0a",
"emulator_response_len": 35,
"bytes_in": 26,
"payload_entropy": 2.4036952254383603,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "rtcp",
"app_proto": "rtcp",
"asn": 211298,
"country": "GB",
"dst_port": 5005,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "84fe549de3801c7c74ca8689c64cf21944be678f",
"event_fingerprint": "935876685e8ba9f35ab349392110479ac1abaa0f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "rtcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d78f671a24b64ce7ead958c033b03484",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 5005,
"service": "rtcp",
"service_name": "rtcp",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"request_sample": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"evidence": {
"request_sample": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"payload_snippet": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4195e19b191eaddea28184939757e1e156860f40",
"protocol_details": {
"payload_preview": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"port": 5005,
"service": "rtcp",
"service_label_fr": "RTCP"
},
"evidence_snippet": "\ufffdU",
"attack_vector": "mssql tds \u00b7 via RTCP:5005 \u00b7 (sonde \/ probe)",
"target_port_label": "5005 \u00b7 RTCP",
"emulator_service": "rtcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "rtcp",
"service_label_fr": "RTCP",
"dst_port": 5005,
"protocol_emulated": true,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtcp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0012\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001\ufffd\b\u0000\u0001U\u0000\u0000\u0001",
"port": 5005,
"service": "rtcp",
"service_label_fr": "RTCP"
},
"attack_vector": "mssql tds \u00b7 via RTCP:5005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdU",
"target_port_label": "5005 \u00b7 RTCP",
"emulator_service": "rtcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtcp",
"service_banner": "honeypot-rtcp",
"service_os": "linux",
"dst_port": "5005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
]
}
|
|
|
TCP |
9814 · REDIS
|
redis
|
Sonde port 9814/TCP
port 9814 tcp · via REDIS:9814 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Commande Redis : *1
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9814
Chemin / cible
—
Preuve honeypot — Sonde port 9814/TCP
Connexion détectée sur le port 9814 (TCP) du capteur simulé.
Service
REDIS
Redis
Commande Redis : *1
Payload
*1 $4 info
Pourquoi cette classification : Type « port_9814_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
65%
Corrélation +10
Risque capteur
Moyen
· 40
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Redis INFO
User-Agent
—
Règles WAF
—
Payload (extrait)
*1
$4
info
Meta JSON brut
{
"bytes_in": 14,
"payload_entropy": 3.128085278891395,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "redis",
"app_proto": "redis",
"asn": 211298,
"country": "GB",
"dst_port": 9814,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 28,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 28,
"novelty": 0
},
"risk_score": 40,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "63ebd985c7ee1bf170b5fe8318315111518f7df2",
"event_fingerprint": "b80176aad183965f8f16d472770b80dedfd8a32e",
"classification_reason": "Type \u00ab port_9814_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0411"
],
"matched_pattern_names": [
"Redis INFO"
],
"pattern_ids": [
"pat-0411"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 28,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "redis",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4f9ff4b8ec8624803229b3cea88426af",
"path_pattern_hash": "a56b82c62f921e3f86714384d0e1f9fb"
},
"target_context": {
"dst_port": 9814,
"service": "redis",
"service_name": "redis",
"risk_score": 40
},
"payload_preview": "*1\r\n$4\r\ninfo\r\n",
"request_sample": "*1\r\n$4\r\ninfo\r\n",
"payload_snippet": "*1\r\n$4\r\ninfo",
"evidence": {
"request_sample": "*1\r\n$4\r\ninfo\r\n",
"payload_snippet": "*1\r\n$4\r\ninfo",
"classification_reason": "Type \u00ab port_9814_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef1d1224c4c786ba5775978090ddffcfda80d364",
"protocol_details": {
"redis_command_fr": "Commande Redis : *1",
"payload_preview": "*1\r\n$4\r\ninfo",
"port": 9814,
"service": "redis",
"service_label_fr": "REDIS"
},
"evidence_snippet": "*1\r\n$4\r\ninfo",
"attack_vector": "port 9814 tcp \u00b7 via REDIS:9814 \u00b7 (sonde \/ probe)",
"target_port_label": "9814 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9814_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_9814_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 28,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 9814,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-redis",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"redis_command_fr": "Commande Redis : *1",
"payload_preview": "*1\r\n$4\r\ninfo",
"port": 9814,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port 9814 tcp \u00b7 via REDIS:9814 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*1\r\n$4\r\ninfo",
"target_port_label": "9814 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "honeypot-redis",
"service_os": "linux",
"dst_port": "9814"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
554 · RTSP
|
rtsp
|
Sonde RTSP
rtsp probe · via RTSP:554 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Surveiller
Tags
net_rtsp_probe
rtsp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
OPTIONS * RTSP/1.0 CSeq: 1
Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 47
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0382
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RTSP protocol
HTTP OPTIONS method
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS * RTSP/1.0
CSeq: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 31,
"payload_entropy": 4.082597923010943,
"port_category": "well_known",
"org": "Driftnet Ltd",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 211298,
"country": "GB",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 47,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c612347518e049ce96c448df76dc171f725494ef",
"event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0382",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0382",
"INT-upstream"
],
"matched_patterns": [
"pat-0382",
"pat-0420"
],
"matched_pattern_names": [
"RTSP protocol",
"HTTP OPTIONS method"
],
"pattern_ids": [
"pat-0382",
"pat-0420"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "22efd140cf33afa66c67e67963ca0a78",
"path_pattern_hash": "b1dd2a100b4c2489a836875293183168"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 47
},
"payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n",
"request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n",
"payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"evidence": {
"request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n",
"payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d2f0845769605bc26ebd0a19ea27cdf49255c15",
"protocol_details": {
"payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 47
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0382",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0382",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rtsp_probe",
"rtsp_probe"
]
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP (3389/TCP)
port 3389 tcp · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Preuve honeypot — Sonde RDP (3389/TCP)
Connexion détectée sur le port 3389 (TCP) du capteur simulé.
Service
RDP
Payload
*1 $4 info
Pourquoi cette classification : Type « port_3389_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
65%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Redis INFO
User-Agent
—
Règles WAF
—
Payload (extrait)
*1
$4
info
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 14,
"payload_entropy": 3.128085278891395,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "rdp",
"app_proto": "rdp",
"asn": 211298,
"country": "GB",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aa4bea48009056c8c3884e795b29aa79232ecca7",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_reason": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0411"
],
"matched_pattern_names": [
"Redis INFO"
],
"pattern_ids": [
"pat-0411"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "rdp",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4f9ff4b8ec8624803229b3cea88426af",
"path_pattern_hash": "eb3d82ddd64e24c65658a8ee92a2ad53"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 42
},
"payload_preview": "*1\r\n$4\r\ninfo\r\n",
"request_sample": "*1\r\n$4\r\ninfo\r\n",
"payload_snippet": "*1\r\n$4\r\ninfo",
"evidence": {
"request_sample": "*1\r\n$4\r\ninfo\r\n",
"payload_snippet": "*1\r\n$4\r\ninfo",
"classification_reason": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8596194352e0844461002c400baeb334a5c8b8c3",
"protocol_details": {
"payload_preview": "*1\r\n$4\r\ninfo",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "*1\r\n$4\r\ninfo",
"attack_vector": "port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "*1\r\n$4\r\ninfo",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*1\r\n$4\r\ninfo",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
]
}
|
|
|
TCP |
20257
|
—
|
Sonde port 20257
Sonde port · port 20257 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20257
Chemin / cible
—
Payload
2 MQIsdp < $065c4dca-296a-4b28-a7e2-19e5ecc77c9f
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
2 MQIsdp < $065c4dca-296a-4b28-a7e2-19e5ecc77c9f
Meta JSON brut
{
"bytes_in": 52,
"payload_entropy": 4.5584382184246675,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": null,
"app_proto": null,
"asn": 211298,
"country": "GB",
"dst_port": 20257,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "fa159067ea7ef6a6ed6a1ede48eeb1c0074f844b",
"event_fingerprint": "fed85086d8bc339325a7aa43c8f33e9498a11b71",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bb1225333bdc39b9b4abbb72ec87481",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20257,
"risk_score": 44
},
"payload_preview": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"request_sample": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"payload_snippet": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"evidence": {
"request_sample": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"payload_snippet": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945955f4825743b78d6d6cc1d99194b2ecdd172e",
"protocol_details": {
"payload_preview": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"port": 20257
},
"evidence_snippet": "2MQIsdp<$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"attack_vector": "Sonde port \u00b7 port 20257 \u00b7 (sonde \/ probe)",
"target_port_label": "20257",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20257,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u00102\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"port": 20257
},
"attack_vector": "Sonde port \u00b7 port 20257 \u00b7 (sonde \/ probe)",
"evidence_snippet": "2MQIsdp<$065c4dca-296a-4b28-a7e2-19e5ecc77c9f",
"target_port_label": "20257",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20257"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"mqtt",
"port:20257"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
20257 · MQTT
|
mqtt
|
Sonde MQTT
mqtt probe · via MQTT:20257 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1046
TA0007
TA0001
Protocole
Connexion MQTT (CONNECT)
Émulateur
MQTT
WAF
—
Recommandation
Investiguer
Tags
mqtt_connect
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20257
Chemin / cible
—
Service
MQTT
MQTT
Connexion MQTT (CONNECT)
Payload
MQTT <
Pourquoi cette classification : Type « mqtt_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Signaux
pat-0373
pat-0615
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MQTT protocol
MQTT alt CONNECT
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 14,
"payload_entropy": 2.950212064914747,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "mqtt",
"app_proto": "mqtt",
"asn": 211298,
"country": "GB",
"dst_port": 20257,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 50,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "38990b1c5c6e1b22769f1c7b1db1d3d0553b7897",
"event_fingerprint": "889f3b2acffa367c501802544e9dc9c0a57ca4ec",
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0373",
"pat-0615",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0373",
"pat-0615",
"INT-upstream"
],
"matched_patterns": [
"pat-0373",
"pat-0615",
"pat-0554"
],
"matched_pattern_names": [
"MQTT protocol",
"MQTT alt CONNECT",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0373",
"pat-0615",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "mqtt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a48086c4358e8ef85de81d0614bcca5",
"path_pattern_hash": "4449b927317468afa12a2f935a413459"
},
"target_context": {
"dst_port": 20257,
"service": "mqtt",
"service_name": "mqtt",
"risk_score": 50
},
"payload_preview": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"request_sample": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"payload_snippet": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"evidence": {
"request_sample": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"payload_snippet": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73c4ead46515af8d50d4ed0a22c5a225a3d4f842",
"protocol_details": {
"mqtt_connect_fr": "Connexion MQTT (CONNECT)",
"payload_preview": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"port": 20257,
"service": "mqtt",
"service_label_fr": "MQTT"
},
"evidence_snippet": "MQTT<",
"attack_vector": "mqtt probe \u00b7 via MQTT:20257 \u00b7 (sonde \/ probe)",
"target_port_label": "20257 \u00b7 MQTT",
"emulator_service": "mqtt",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTT \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "mqtt",
"service_label_fr": "MQTT",
"dst_port": 20257,
"protocol_emulated": null,
"tags_summary": [
"pat-0373",
"pat-0615",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0373",
"pat-0615",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mqtt",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"mqtt_connect_fr": "Connexion MQTT (CONNECT)",
"payload_preview": "\u0010\f\u0000\u0004MQTT\u0004\u0002\u0000<\u0000\u0000",
"port": 20257,
"service": "mqtt",
"service_label_fr": "MQTT"
},
"attack_vector": "mqtt probe \u00b7 via MQTT:20257 \u00b7 (sonde \/ probe)",
"evidence_snippet": "MQTT<",
"target_port_label": "20257 \u00b7 MQTT",
"emulator_service": "mqtt",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mqtt",
"service_banner": "honeypot-mqtt",
"service_os": "linux",
"dst_port": "20257"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"mqtt",
"port:20257"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"mqtt_connect"
]
}
|
|
|
TCP |
20257
|
—
|
Sonde port 20257
Sonde port · port 20257 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20257
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": null,
"app_proto": null,
"asn": 211298,
"country": "GB",
"dst_port": 20257,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "fa159067ea7ef6a6ed6a1ede48eeb1c0074f844b",
"event_fingerprint": "fed85086d8bc339325a7aa43c8f33e9498a11b71",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20257,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7382d80b920461582fc3c1971c1fb8e38ded40f7",
"protocol_details": {
"port": 20257
},
"attack_vector": "Sonde port \u00b7 port 20257 \u00b7 (sonde \/ probe)",
"target_port_label": "20257",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20257,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 20257
},
"attack_vector": "Sonde port \u00b7 port 20257 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "20257",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20257"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|