|
|
TCP |
502 · MODBUS
|
modbus
|
Sonde Modbus (OT)
modbus probe · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T0836
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
~�Z�5G�V�#� ���5����(T{�ް�� �#��q�=��l�Bdo��:3]b��?u�趴� <�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =��
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
~�Z�5G�V�#� ���5����(T{�ް�� �#��q�=��l�Bdo��:3]b��?u�趴� <�+�/�,�0̨̩� ��
� � � / 5��
�$�(�#�' < =��
Requête brute (extrait)
~�Z�5G�V�#� ���5����(T{�ް�� �#��q�=��l�Bdo��:3]b��?u�趴� <�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =�� � � + 3 & $ s�:�8(��� �}�Y͒Q
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0001020000",
"emulator_response_len": 5,
"bytes_in": 271,
"payload_entropy": 5.7721940732878325,
"port_category": "well_known",
"org": "Driftnet Ltd",
"service": "modbus",
"app_proto": "modbus",
"asn": 211298,
"country": "GB",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71872130bb5b9bc70e08e1195915be62e8b7489c",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5157a039088c96ba90b2315b5be40e61",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\u001e\u0012\ufffd\ufffd\ufffd\u000e\u00105\ufffd\ufffd\ufffd\ufffd(\u0003T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3\u001a]b\ufffd\u001a\u0018\ufffd?u\ufffd\u8db4\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\u001e\u0012\ufffd\ufffd\ufffd\u000e\u00105\ufffd\ufffd\ufffd\ufffd(\u0003T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3\u001a]b\ufffd\u001a\u0018\ufffd?u\ufffd\u8db4\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 s\ufffd:\ufffd8(\ufffd\ufffd\ufffd\u001c\ufffd}\ufffdY\u0352Q",
"payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\u001e\u0012\ufffd\ufffd\ufffd\u000e\u00105\ufffd\ufffd\ufffd\ufffd(\u0003T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3\u001a]b\ufffd\u001a\u0018\ufffd?u\ufffd\u8db4\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3914537ba2300396521a16e73bf8f34bed7c1f05",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\u001e\u0012\ufffd\ufffd\ufffd\u000e\u00105\ufffd\ufffd\ufffd\ufffd(\u0003T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3\u001a]b\ufffd\u001a\u0018\ufffd?u\ufffd\u8db4\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd(T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3]b\ufffd\ufffd?u\ufffd\u8db4\ufffd<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\u001e\u0012\ufffd\ufffd\ufffd\u000e\u00105\ufffd\ufffd\ufffd\ufffd(\u0003T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3\u001a]b\ufffd\u001a\u0018\ufffd?u\ufffd\u8db4\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "~\ufffdZ\ufffd5G\ufffdV\ufffd#\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd(T{\ufffd\u07b0\ufffd\ufffd \ufffd#\ufffd\ufffdq\ufffd=\ufffd\ufffdl\ufffdBdo\ufffd\ufffd:3]b\ufffd\ufffd?u\ufffd\u8db4\ufffd<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
1521 · ORACLE
|
oracle
|
Sonde Oracle TNS
oracle tns probe · via ORACLE:1521 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ORACLE
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_emulated
oracle_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1521
Chemin / cible
—
Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f002e0000060000000000280000000c41434345505428444541444245454629",
"emulator_response_len": 33,
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "oracle",
"app_proto": "oracle",
"asn": 211298,
"country": "GB",
"dst_port": 1521,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6ae991b50c5b39ecc1e4f95d7240d75e52b8c353",
"event_fingerprint": "5e232d65a022f2a64f918c38abebffe661d59604",
"classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "oracle",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f4e2f1a103bb922ff42b612ff7eb3c93",
"path_pattern_hash": "420e91c120535c16728a9791d446fafc"
},
"target_context": {
"dst_port": 1521,
"service": "oracle",
"service_name": "oracle",
"risk_score": 34
},
"payload_preview": "\ufffd\u0001",
"request_sample": "\ufffd\u0001",
"payload_snippet": "\ufffd\u0001",
"evidence": {
"request_sample": "\ufffd\u0001",
"payload_snippet": "\ufffd\u0001",
"classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae54ee33f8fad3696ed0614a093bbd0d1190b2dd",
"protocol_details": {
"payload_preview": "\ufffd\u0001",
"port": 1521,
"service": "oracle",
"service_label_fr": "ORACLE"
},
"evidence_snippet": "\ufffd",
"attack_vector": "oracle tns probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)",
"target_port_label": "1521 \u00b7 ORACLE",
"emulator_service": "oracle",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "oracle",
"service_label_fr": "ORACLE",
"dst_port": 1521,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\u0001",
"port": 1521,
"service": "oracle",
"service_label_fr": "ORACLE"
},
"attack_vector": "oracle tns probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "1521 \u00b7 ORACLE",
"emulator_service": "oracle",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle",
"service_banner": "honeypot-oracle",
"service_os": "linux",
"dst_port": "1521"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_oracle_tns_probe",
"oracle_emulated",
"oracle_payload"
]
}
|
|
|
TCP |
502 · MODBUS
|
modbus
|
Sonde Modbus (OT)
modbus probe · via MODBUS:502 · (sonde / probe)
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
/multistream/1.0.0
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
/multistream/1.0.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 20,
"payload_entropy": 3.821928094887362,
"port_category": "well_known",
"org": "Driftnet Ltd",
"service": "modbus",
"app_proto": "modbus",
"asn": 211298,
"country": "GB",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 22,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1df3a12ec0dbfaa23bb48ea99bf5912c8211349a",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 22,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0f9615236cb2e463b69829a7f95f1f77",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 22
},
"payload_preview": "\u0013\/multistream\/1.0.0\n",
"request_sample": "\u0013\/multistream\/1.0.0\n",
"payload_snippet": "\u0013\/multistream\/1.0.0",
"evidence": {
"request_sample": "\u0013\/multistream\/1.0.0\n",
"payload_snippet": "\u0013\/multistream\/1.0.0",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "841d393d063bcd399c43e96b4ec728569fadd258",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0013\/multistream\/1.0.0",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "\/multistream\/1.0.0",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 22,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0013\/multistream\/1.0.0",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/multistream\/1.0.0",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe"
]
}
|
|
|
TCP |
1024 · KDM
|
kdm
|
Sonde HTTP smuggling
http smuggling probe · via KDM:1024 · (tentative d'exploit)
|
Faible
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
KDM
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1024
Chemin / cible
—
Service
KDM
Payload
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme Max-Forwards: 0 To: sip:62.3.
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
SIP protocol
HTTP OPTIONS method
SIP OPTIONS
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0
Via: SIP/2.0/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme
Max-Forwards: 0
To: sip:62.3.
Requête brute (extrait)
OPTIONS sip:62.3.50.33 SIP/2.0 Via: SIP/2.0/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme Max-Forwards: 0 To: sip:62.3.50.33 From: sip:195.96.139.59;tag=vophjqme Call-ID: vophjqme CSeq: 1 OPTIONS Accept: application/sdp Content-Length: 0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b646d20726561647920706f72743d313032340d0a",
"emulator_response_len": 34,
"bytes_in": 255,
"payload_entropy": 5.40839764131808,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "kdm",
"app_proto": "kdm",
"asn": 211298,
"country": "GB",
"dst_port": 1024,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 52,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ccde789d610d1ba821f63a3b92c28422ad13919b",
"event_fingerprint": "8d02847b2b407065d9d20c3fd24010f633fa1d13",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0384",
"pat-0420",
"pat-0535"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SIP protocol",
"HTTP OPTIONS method",
"SIP OPTIONS"
],
"pattern_ids": [
"pat-0842",
"pat-0384",
"pat-0420",
"pat-0535"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "kdm",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a9a78c40fb3edbb94e0ece1c1ca2eefc",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 1024,
"service": "kdm",
"service_name": "kdm",
"risk_score": 52
},
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.50.33\r\nFrom: sip:195.96.139.59;tag=vophjqme\r\nCall-ID: vophjqme\r\nCSeq: 1 OPTIONS\r\nAccept: application\/sdp\r\nContent-Length: 0\r\n\r\n",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"evidence": {
"request_sample": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.50.33\r\nFrom: sip:195.96.139.59;tag=vophjqme\r\nCall-ID: vophjqme\r\nCSeq: 1 OPTIONS\r\nAccept: application\/sdp\r\nContent-Length: 0\r\n\r\n",
"payload_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d258a4101c42d862402157ba6eabd65929817f65",
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"port": 1024,
"service": "kdm",
"service_label_fr": "KDM"
},
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"attack_vector": "http smuggling probe \u00b7 via KDM:1024 \u00b7 (tentative d'exploit)",
"target_port_label": "1024 \u00b7 KDM",
"emulator_service": "kdm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via KDM \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "kdm",
"service_label_fr": "KDM",
"dst_port": 1024,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kdm",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"port": 1024,
"service": "kdm",
"service_label_fr": "KDM"
},
"attack_vector": "http smuggling probe \u00b7 via KDM:1024 \u00b7 (tentative d'exploit)",
"evidence_snippet": "OPTIONS sip:62.3.50.33 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 195.96.139.59:5060;rport;branch=z9hG4bKvophjqme\r\nMax-Forwards: 0\r\nTo: sip:62.3.",
"target_port_label": "1024 \u00b7 KDM",
"emulator_service": "kdm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kdm",
"service_banner": "honeypot-kdm",
"service_os": "linux",
"dst_port": "1024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"kdm",
"port:20337"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
20337
|
—
|
Sonde port 20337
Sonde port · port 20337 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20337
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
a�e /00IDED
Meta JSON brut
{
"bytes_in": 14,
"payload_entropy": 3.378783493486176,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": null,
"app_proto": null,
"asn": 211298,
"country": "GB",
"dst_port": 20337,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e1c705164efb7572c7566355eab5024b05bcadfb",
"event_fingerprint": "5e432abd0b1b5e2c661d1acee05a7e5f67ec2339",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25c3884eea276429fd89af6bb43c12ee",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20337,
"risk_score": 44
},
"payload_preview": "a\ufffde\u0000\u000e\u0000\/00IDED\r",
"request_sample": "a\ufffde\u0000\u000e\u0000\/00IDED\r",
"payload_snippet": "a\ufffde\u0000\u000e\u0000\/00IDED",
"evidence": {
"request_sample": "a\ufffde\u0000\u000e\u0000\/00IDED\r",
"payload_snippet": "a\ufffde\u0000\u000e\u0000\/00IDED",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2407fcd547d78e52ddd0af9d7d51e2d4ca2e728",
"protocol_details": {
"payload_preview": "a\ufffde\u0000\u000e\u0000\/00IDED",
"port": 20337
},
"evidence_snippet": "a\ufffde\/00IDED",
"attack_vector": "Sonde port \u00b7 port 20337 \u00b7 (sonde \/ probe)",
"target_port_label": "20337",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20337,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "a\ufffde\u0000\u000e\u0000\/00IDED",
"port": 20337
},
"attack_vector": "Sonde port \u00b7 port 20337 \u00b7 (sonde \/ probe)",
"evidence_snippet": "a\ufffde\/00IDED",
"target_port_label": "20337",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
20337
|
—
|
Sonde port 20337
Sonde port · port 20337 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20337
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": null,
"app_proto": null,
"asn": 211298,
"country": "GB",
"dst_port": 20337,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e1c705164efb7572c7566355eab5024b05bcadfb",
"event_fingerprint": "5e432abd0b1b5e2c661d1acee05a7e5f67ec2339",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20337,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6f2c1d22570739df543156c4d44dd231764fd0c",
"protocol_details": {
"port": 20337
},
"attack_vector": "Sonde port \u00b7 port 20337 \u00b7 (sonde \/ probe)",
"target_port_label": "20337",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20337,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 20337
},
"attack_vector": "Sonde port \u00b7 port 20337 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "20337",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "195.96.139.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
11740 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:11740 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a7da2bc4375750ea
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11740
Chemin / cible
—
Service
TLS
Payload
� �В�i��|T 3+��� ��������n�� �b��Pd�)� ���'� wF9W� b:��� �+�,�/�0̨̩ � � @ +
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��i��|T 3+��� ��������n�� �b��Pd�)�
���'� wF9W� b:��� �+�,�/�0̨̩ � � @ +
Requête brute (extrait)
� �В�i��|T 3+��� ��������n�� �b��Pd�)� ���'� wF9W� b:��� �+�,�/�0̨̩ � � @ + http/1.1h2 � #
Meta JSON brut
{
"tls_ja3_hash": "a7da2bc4375750ea67e9e97d561b1fdd",
"tls_sni": null,
"tls_alpn": [
"http\/1.1",
"h2"
],
"bytes_in": 162,
"payload_entropy": 5.622223732016405,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 211298,
"country": "GB",
"dst_port": 11740,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "d26b392dd7810dfad251bb3d1e8651e4f391780d",
"event_fingerprint": "d6dd5efa6d289fae105de16f4a0a00347e659175",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a7da2bc4375750ea67e9e97d561b1fdd",
"payload_hash": "f3f7fcb19ac60f7fd773dfd4a9be9551",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "f3504069efddbf2644c62545ebe546be",
"tls_version": "0x0303",
"tls_cipher_count": 8,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49196-49199-49200-52393-52392-156-157,43-10-13-16-23-22-65281-35,23-29,",
"tls_ja4_hash": "f3504069efddbf2644c62545ebe546be",
"tls_ja4": "t13d0108_94ebcd170458_257101d612d5",
"tls_version": "0x0303",
"tls_cipher_count": 8,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 11740,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0412\ufffdi\ufffd\ufffd|T\u001e3+\ufffd\ufffd\uf7bb\ufffd\f\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\u0015\ufffd\ufffd'\ufffd\u001dwF\u000e9W\u0014\ufffd\u0000\u000fb:\ufffd\u0011\ufffd\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0412\ufffdi\ufffd\ufffd|T\u001e3+\ufffd\ufffd\uf7bb\ufffd\f\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\u0015\ufffd\ufffd'\ufffd\u001dwF\u000e9W\u0014\ufffd\u0000\u000fb:\ufffd\u0011\ufffd\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000\u0010\u0000\u000e\u0000\f\bhttp\/1.1\u0002h2\u0000\u0017\u0000\u0000\u0000\u0016\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0412\ufffdi\ufffd\ufffd|T\u001e3+\ufffd\ufffd\uf7bb\ufffd\f\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\u0015\ufffd\ufffd'\ufffd\u001dwF\u000e9W\u0014\ufffd\u0000\u000fb:\ufffd\u0011\ufffd\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be9376e712a516aee85ddff0217c89f6efa74b8f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0412\ufffdi\ufffd\ufffd|T\u001e3+\ufffd\ufffd\uf7bb\ufffd\f\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\u0015\ufffd\ufffd'\ufffd\u001dwF\u000e9W\u0014\ufffd\u0000\u000fb:\ufffd\u0011\ufffd\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000",
"tls_ja3": "a7da2bc4375750ea67e9e97d561b1fdd",
"tls_ja4": "f3504069efddbf2644c62545ebe546be",
"port": 11740,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0412\ufffdi\ufffd\ufffd|T3+\ufffd\ufffd\uf7bb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\ufffd\ufffd'\ufffdwF9W\ufffdb:\ufffd\ufffd\ufffd\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\ufffd\ufffd@+",
"attack_vector": "tls probe \u00b7 via TLS:11740 \u00b7 (sonde \/ probe)",
"target_port_label": "11740 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 11740,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0412\ufffdi\ufffd\ufffd|T\u001e3+\ufffd\ufffd\uf7bb\ufffd\f\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\u0015\ufffd\ufffd'\ufffd\u001dwF\u000e9W\u0014\ufffd\u0000\u000fb:\ufffd\u0011\ufffd\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000",
"tls_ja3": "a7da2bc4375750ea67e9e97d561b1fdd",
"tls_ja4": "f3504069efddbf2644c62545ebe546be",
"port": 11740,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:11740 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0412\ufffdi\ufffd\ufffd|T3+\ufffd\ufffd\uf7bb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffdb\ufffd\ufffdPd\ufffd)\ufffd\n\ufffd\ufffd\ufffd'\ufffdwF9W\ufffdb:\ufffd\ufffd\ufffd\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\ufffd\ufffd@+",
"target_port_label": "11740 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "11740"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|