|
|
TCP |
9999 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9999
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 9999,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "30754b68c4056cfff8bf21580a58f7c1e73a3619",
"event_fingerprint": "089ca88ea6be54d532c3b4acd1bd8a7d5d97931c",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc8f3740171db43950c29b543d20759b053115e4",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 82.52,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
HTTP alt 8888 probe
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "97814aef2db420b5ab2370cf6e6045e74d6b3c81",
"event_fingerprint": "0eed67143a5bba0048d3e7aa9c6da819ac740eb8",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0599"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0103",
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "446983582176ef6efe96b156f1fec491bb34a685",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 81.28,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ac7670ca90cd245f1012c80bf28b11a4af6f7f04",
"event_fingerprint": "bca25bd7cb7a98566b173ab6e5aecf573b3eb9f9",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e193255253ba9babf6e497d9d06d33b1212e6fcf",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 79.68,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9091 · KAFKA JMX
|
kafka-jmx
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9091
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a",
"emulator_response_len": 40,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "kafka-jmx",
"app_proto": "kafka-jmx",
"asn": 58224,
"country": "IR",
"dst_port": 9091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0b05a5c74c13e8c5b12f5b65c82dd02efa2a1023",
"event_fingerprint": "ce2c4f2c3ed924aedc3da83d66dd2d0ca13b4808",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "kafka-jmx",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9091,
"service": "kafka-jmx",
"service_name": "kafka-jmx",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26e5fbe2dbe24b7d35d5c5fc1e8437434f6149a9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka-jmx",
"service_label_fr": "KAFKA JMX",
"dst_port": 9091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-jmx",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_jmx",
"service_banner": "honeypot-kafka-jmx",
"service_os": "linux",
"dst_port": "9091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 78.61,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
1085 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1085
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 1085,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "43b1053bbf74056962d89f51e620bf3ba67e0457",
"event_fingerprint": "8a16af56d8a300f5ba32d396340a389d039a09b4",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 1085,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f996f2c4a708b2fc6957b264288ae8b6acae4ec6",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1085,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 77.35,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1086 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1086
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 1086,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9abb5354c7a0a7c354c82bfdfecddbca0e44ef78",
"event_fingerprint": "45adf550fcfcad36cd354bf314110d2c13655250",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 1086,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f17cd9bb0383b2951207fea048ebe5941a026a36",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1086,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 76.15,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
1083
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1083
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1083,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "cdf9b0c3d18e6808f9ffdbcfc89d83a5aa1038e6",
"event_fingerprint": "fc20528dbcb1246f2e318d68928619a33cb95338",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1083,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2ec9413666bb3df2839dd5fe7be6245b272cac2",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1083,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 57.1,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1084
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1084
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ae4613d407ed5177def0346f393f3b87a58b1dd0",
"event_fingerprint": "cbaa0dd93e36bebb2aae5cfc42a316ae5b29a66f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1084,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f081671a0075393d6397f0a4685b249cc023f53",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1084,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 56.83,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0933d86277308ac3139aad04628c9c7a1d2df02e",
"event_fingerprint": "1239ae2c57e26fc98fadd90389dc449932bdda6c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ad0c12ce9669b028a5ec69cf1ba3be9364e5d48",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 56.05,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1082
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1082
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1082,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e2374f9bde049c79839aa299d3b1d95c754e8639",
"event_fingerprint": "53e2fefa66ffcc7ef98b0b60afa96a76ace5d929",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1082,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c303c7ae6018a3ff9e57968277cbc274fcf2823d",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1082,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 55.34,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1087
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1087
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1087,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3cfc25b4768f5993fbe7d02e4d04b3502784e3f6",
"event_fingerprint": "d9695596737bf6c880a2cdd3c8a99197f66dc148",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1087,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "befb592a457025960664e212d3d461dfc46dc3af",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1087,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 52.84,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1089
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1089
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1089,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "95e9755d972cdc36be0438eedd97c06eb289162f",
"event_fingerprint": "159aff3a58efeb55a179c1ac785f82458cc67ef3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1089,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e1934e00b135b1c308ea33e2f0b93d09e5a87c0",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1089,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 52.05,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8002 · HTTP ALT 8002
|
http-alt-8002
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8002
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http-alt-8002",
"app_proto": "http-alt-8002",
"asn": 58224,
"country": "IR",
"dst_port": 8002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "cf3db1a1586ee5e1ee0461c76989fb07bb0d30e2",
"event_fingerprint": "e606d9f69f6abce173a9b8bb4b1fc880da15ada3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http-alt-8002",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8002,
"service": "http-alt-8002",
"service_name": "http-alt-8002",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95b0d3876d9a65303373e142795ca58c331b50f1",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8002",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8002",
"service_banner": "honeypot-http-alt-8002",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 51.31,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
net_slowloris
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
SOCKS5 greeting
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a0550b56b933066c11c8762d71f0874244fc70ea",
"event_fingerprint": "1a73e52fcb0af206bdd873fdc276f059b19b837a",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0567"
],
"matched_pattern_names": [
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0567"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e68b7defe49c932c4fdc1f54f537c8e7e1177f12",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 51.02,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast",
"net_slowloris"
]
}
|
|
|
TCP |
1081
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f46ff2bdcd6bcf48decbc27977a3f3f41f7e2e6a",
"event_fingerprint": "5b5970c23349ad1a0d59675fa4a85ab73bd663a9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1081,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ec2c01696238624128de6560eb011dde77afacf",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 50.84,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "socks5",
"app_proto": "socks5",
"asn": 58224,
"country": "IR",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b3138a87fa61eeaee13759d4efdb4ff726d18030",
"event_fingerprint": "dc2e01e414bde3aa47dfa7a38a4e4393eddba8cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09c72158edd216fac2c516624d3d5f2d203826a6",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 50.49,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_emulated"
]
}
|
|
|
TCP |
9000 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
net_slowloris
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
9000
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
SOCKS5 greeting
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 9000,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "92fef4ca07dab86f42d0b3b72617b9cd4e9453bb",
"event_fingerprint": "23dd8620e82dd7d29b08cc2b43d4905facc7c62e",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0567"
],
"matched_pattern_names": [
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0567"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7b41f13d03d11f12c00bab47a5abce060c3c276",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 50.21,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast",
"net_slowloris"
]
}
|
|
|
TCP |
1086
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1086
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1086,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4604e98624a0399a3cf12e7209ec5370f366b4db",
"event_fingerprint": "1501ffe1b4c75ffaf48f719ae843c075fc143c91",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1086,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0d39244bba637b41719d6f88b231af7b48461ef",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1086,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 47.62,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1085
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1085
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1085,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "51b1db623b7aaad946a34fceee8def3e9ee6a454",
"event_fingerprint": "9e602bc1bf8d2c99ba9706669905bc6d6505d056",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1085,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcd37cc0576527316bf493fe46bb74b4572aa7c0",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1085,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 46.41,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
1081 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1081
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 1081,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "52dfa0b1399a7dc8427620f8c05663c7c3ca0858",
"event_fingerprint": "2e5d4c46650a574fadad25ee5c48d166b8407578",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 1081,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "454556fceba274b7a237d23c1e987991f19d242c",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 91.22,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "socks5",
"app_proto": "socks5",
"asn": 58224,
"country": "IR",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "26b38bfcba7e5e5c76a8fd6479a79ae500391369",
"event_fingerprint": "dc2e01e414bde3aa47dfa7a38a4e4393eddba8cb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a299a29df120dd5456eec9711a82485a6a1847b2",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 90.76,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
9000 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9000
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 9000,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "057c57a5acf2f3a72bf3664a25847759a08f8ab0",
"event_fingerprint": "a5776a4767d4afe9b297c157aae73f0cabd35c98",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "230228bfc9bdacfdbca5c37ab43cd7ad17f0e2e0",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 89.23,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
1089 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1089
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 1089,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d37cf0ccb7501e38902c6c4487e2205c61deac76",
"event_fingerprint": "e8fe48f8565e13776b444d733d6a5ff1d3d27e6b",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 1089,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b96b9214a35a1128541d948f5c11898c400ef453",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1089,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 87.77,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8002 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8002
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8002,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2998090c4845816e89f34836589d122e9a43f912",
"event_fingerprint": "dc3222c95731052ece45618f2bbd4214bbf76e6f",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e4a65bb2ac21be747922f11f74090a373843ff5",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 86.36,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8081 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8081
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8081,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c60d9fd02728c0de5dbcec6739f65339ef18e63a",
"event_fingerprint": "18ec8f8ef29181e350273ca9dfcdb4f4c228ec80",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "820bb511ac0001373a201742391386e61cafd2f4",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 85.06,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8118 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_absolute_uri
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8118
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://example.com/ HTTP/1.1
User-Agent
goBrrrr/1.0
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0ad76209ecb9a0566f4e7f81ab6b52354b186423",
"http_host_hash": "0caaf24ab1a0c33440c06afe99df986365b0781f",
"http_target_hash": "9c17e047f58f9220a7008d4f18152fee4d111d14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8118,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f398535b80824a1deec613d82077520b6c464e6b",
"event_fingerprint": "fdaeac3756cf53e2f04deeacb157f4333c3fe835",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fe0988cbfb07a49a43094edefd650b00",
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "2a1b402420ef46577471cdc7409b0fa2"
},
"target_context": {
"dst_port": 8118,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "goBrrrr\/1.0",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/example.com\/ HTTP\/1.1",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6c5da8b64963332dc05793ea7edddb761ca2498",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 25,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 25,
"scan_velocity_ports_per_s": 83.78,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_port_scan_fast"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1082
|
—
|
proxy probe
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1082
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1082,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1166a7abc43cebae5981891a964720b57f908295",
"event_fingerprint": "e9f5f09f3c579a5a3cb23c64bca8a57673dfd747",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1082,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d96a8edbf02b6da16a473163b4fddfa279c58140",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1082,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1087
|
—
|
proxy probe
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1087
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1a6bd4e0ddadcd72bc26aacd821155b4c309df64",
"event_fingerprint": "f17a0c20528aa8d4bfd59fbe99c6684cd5cbe583",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1087,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e121868252562414c80f4cd2201705beb55ede48",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1087,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1083
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1083
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +4
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1083,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "221820a18b65ee6d86b1ce21899934df2272bc86",
"event_fingerprint": "df2d32fd9833465c9f02e7504109b30fefd8bc8e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 4
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1083,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d35803d3e68fa27e0f5448b8ffafad578eaba90c",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 4
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1083,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +4"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 30,
"behavior_alerts": [
"rapid_port_scan"
],
"correlation_confidence_boost": 4,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1084
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1084
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0d1f921dc75d84b3b83bbac0e8ebb152cbc684e2",
"event_fingerprint": "20e0624a96ed54d2f127ce929a3ddf1adae02065",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1084,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1de1247135cebabac1e6e148ad9c69d4cef9021d",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1084,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
1082,
1083,
1084,
1087
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 40,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1088
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1088
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "4e7c4ef57ced2822bfecbef2117fb69637933231",
"event_fingerprint": "570a7ce46e45fc71a301e25a9fadd57bbb55637a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1088,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cee95bd1607a6cdbedf72c7a5762a52e8e5e16f",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1088,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
1082,
1083,
1084,
1087,
1088
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 50,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "socks5",
"app_proto": "socks5",
"asn": 58224,
"country": "IR",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3b4509895c86b496ab356c38c42033f4c0ad86b",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
1080,
1082,
1083,
1084,
1087,
1088
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 60,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1081
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "23a4b5e2adf47a9305e898f7897eae0ee58fc794",
"event_fingerprint": "35f50dad8283ad1fc1432bed469c94a0d1d87aa1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1081,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59378bd8fe559dfed3c188543c9bcbeb3e3a9eb3",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1087,
1088
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 70,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1089
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1089
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1089,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "4b1b6cb382b1113e469b9f01af15a920afd2ee57",
"event_fingerprint": "7153360ea0fd0251b13f08287f012f08c0201cef",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1089,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73177861ffbd08e653b440ced03316d96f8b6a1a",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1089,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 80,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1085
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1085
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1085,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d31b117f499bc2373ce26a7d630d7ca498b55c51",
"event_fingerprint": "962c5d2bc40d56b26cc10e776bf88b85381e8281",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1085,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf972801fb9a672e35b2af404e286590373873cc",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1085,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 90,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
1086
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1086
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 1086,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "dcb27b6ce0bb43ef76e9461e90df979029dc8c8c",
"event_fingerprint": "53fe7b01c5151529fdeba64e0a980e55c286c8aa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 1086,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bd3929a1f1a25c37ee845acf6acdca4e6333506",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 1086,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 100,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|
|
|
TCP |
8002 · HTTP ALT 8002
|
http-alt-8002
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_proxy_probe
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8002
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http-alt-8002",
"app_proto": "http-alt-8002",
"asn": 58224,
"country": "IR",
"dst_port": 8002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "de7e2ab029aeec58e2ba82d0d9032bbcc9640c1c",
"event_fingerprint": "279ba1784b49af0ffbe80d226b52c4db14c9c97f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 171,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http-alt-8002",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8002,
"service": "http-alt-8002",
"service_name": "http-alt-8002",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77c149277f159b4b0724d94dac1c6c6e6ce9e9a2",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8002",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8002",
"service_banner": "honeypot-http-alt-8002",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
8002
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 110,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_proxy_probe",
"socks5_greeting"
]
}
|
|
|
TCP |
3128 · SQUID
|
squid
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
squid_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3128
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e31203430372050726f78792041757468656e7469636174696f6e2052657175697265640d0a50726f78792d41757468656e7469636174653a204261736963207265616c6d3d227371756964220d0a436f6e74656e742d4c656e6774683a2034360d0a0d0a3c68746d6c3e3c626f64793e53717569642070726f",
"emulator_response_len": 153,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "squid",
"app_proto": "squid",
"asn": 58224,
"country": "IR",
"dst_port": 3128,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "15ca89b633d18727453f90e7a661eb0f63be227c",
"event_fingerprint": "e4052446aafc30e0d58f241bc668d49bd3854faa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "squid",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3128,
"service": "squid",
"service_name": "squid",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d19692cbc6ec4b6d298a84f8b3cf0cfe7703fecb",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "squid",
"service_label_fr": "SQUID",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-squid",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "squid",
"service_banner": "honeypot-squid",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8002
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 120,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting",
"squid_emulated"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
8080
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
SOCKS5 greeting
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8080,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1952973b298753bacd8311ca7b61685d03229984",
"event_fingerprint": "1a73e52fcb0af206bdd873fdc276f059b19b837a",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0567"
],
"matched_pattern_names": [
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0567"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9deea9755296660da79aea694c755254f8c4645b",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8002,
8080
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 130,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
10808
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10808
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 10808,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "91c2d47bb099796e326c4f546cd9f20cddd44321",
"event_fingerprint": "8eb5f1785723ab9d1c617e64bec5733293d1a7e9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10808,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bdbe08573836a77252109b68ede21f211f362c34",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 10808,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10808"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8002,
8080,
10808
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 14,
"scan_velocity_ports_per_s": 140,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
8888
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
SOCKS5 greeting
HTTP alt 8888 probe
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 8888,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "05c58c5f19ad288de9a49d67ac759a6d356e63bd",
"event_fingerprint": "80f2aa9a52b555c26e5706a111edbf5b4c7d378f",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0567",
"pat-0599"
],
"matched_pattern_names": [
"SOCKS5 greeting",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0567",
"pat-0599"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7191baa6fa25f3c568b57944075543e1869662cc",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8002,
8080,
8888,
10808
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 150,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: goBrrrr/1.0
Accept: text/html
Accept-Encoding: identity
Conn
Requête brute (extrait)
GET http://example.com/ HTTP/1.1 Host: example.com User-Agent: goBrrrr/1.0 Accept: text/html Accept-Encoding: identity Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 145,
"payload_entropy": 4.782997646615993,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 58224,
"country": "IR",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8cf170279f63c287bad3f27ffae307395f671189",
"event_fingerprint": "35f03245cfcefbc377b60a7eaa4e05d4006fb65d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "632ccbeda8e178e5a65b4fe80d3a80aa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 42
},
"payload_preview": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"evidence": {
"request_sample": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/example.com\/ HTTP\/1.1\r\nHost: example.com\r\nUser-Agent: goBrrrr\/1.0\r\nAccept: text\/html\r\nAccept-Encoding: identity\r\nConn",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75a1786168161d678977fa88ff17ed52ae43511e",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 16,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8888,
10808
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 16,
"scan_velocity_ports_per_s": 160,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"sap_icm_emulated",
"sap_icm_payload"
]
}
|
|
|
TCP |
8082 · HTTP ALT 8082
|
http-alt-8082
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8082
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http-alt-8082",
"app_proto": "http-alt-8082",
"asn": 58224,
"country": "IR",
"dst_port": 8082,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "532a8490dea2570c14b63185626afd070b2ef0f6",
"event_fingerprint": "754fe1c1fd27dff7b9653c1ba3c9f4252e86ae83",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http-alt-8082",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8082,
"service": "http-alt-8082",
"service_name": "http-alt-8082",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c528439493f6c153448a77e49fe6e015485f733a",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082",
"dst_port": 8082,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8082",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8082",
"service_banner": "honeypot-http-alt-8082",
"service_os": "linux",
"dst_port": "8082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 17,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8082,
8888
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 17,
"scan_velocity_ports_per_s": 170,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8118
|
—
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8118
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": null,
"app_proto": null,
"asn": 58224,
"country": "IR",
"dst_port": 8118,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f86895c76562b268901317792ffc7cf5da1798fe",
"event_fingerprint": "951b0bd6f0bd52067bab23cea27c21916ab746e2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8118,
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f843604c1aef876660260ed9e22a579c106b6d1a",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8118,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8118"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 18,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8082,
8118
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 18,
"scan_velocity_ports_per_s": 180,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8081 · HTTP ALT 8081
|
http-alt-8081
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8081
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http-alt-8081",
"app_proto": "http-alt-8081",
"asn": 58224,
"country": "IR",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "2dc5757d1ce566e5b36a106a4411418d84040038",
"event_fingerprint": "4b8d01bf5e0cd8f05e9c73ead2fc5951c1842a92",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http-alt-8081",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8081,
"service": "http-alt-8081",
"service_name": "http-alt-8081",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0967afb05603ca562aa63bf3a3a2fe9ea88d9ae9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8081",
"service_label_fr": "HTTP ALT 8081",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8081",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8081",
"service_banner": "honeypot-http-alt-8081",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 19,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 19,
"scan_velocity_ports_per_s": 190,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "https",
"app_proto": "https",
"asn": 58224,
"country": "IR",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b834661bef8c6b1e12ba72c0636a3e5f81884b1d",
"event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bdb87666744dc737bcdada9d84ce607337e7fbd",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 20,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 20,
"scan_velocity_ports_per_s": 200,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"socks5_greeting"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
9090 · PROMETHEUS
|
prometheus
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
prometheus_emulated
prometheus_payload
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9090
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2036360d0a0d0a232048454c502075702031206966207461726765742069732075702e0a2320545950452075702067617567650a75707b",
"emulator_response_len": 146,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "prometheus",
"app_proto": "prometheus",
"asn": 58224,
"country": "IR",
"dst_port": 9090,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f31e4702f6849fa694186d12ae2068454a8639ae",
"event_fingerprint": "d03f9b99067241df10fe0fa36e187d35e3de6da9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "prometheus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9090,
"service": "prometheus",
"service_name": "prometheus",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17e06bfd3981a8840424c45ae3c4a8669bc55c59",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "prometheus",
"service_label_fr": "PROMETHEUS",
"dst_port": 9090,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-prometheus",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "prometheus",
"service_banner": "honeypot-prometheus",
"service_os": "linux",
"dst_port": "9090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 21,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 21,
"scan_velocity_ports_per_s": 210,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"prometheus_emulated",
"prometheus_payload",
"socks5_greeting"
]
}
|
|
|
TCP |
9000 · HTTP
|
http
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_no_ua
net_port_scan_fast
Cible HTTP
/
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
9000
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
SOCKS5 greeting
Ligne de requête
/ HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "\u0005\u0001\u0000",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "http",
"app_proto": "http",
"asn": 58224,
"country": "IR",
"dst_port": 9000,
"risk_waf": 20,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "79c9e98c4c27e0b950e18ec690d012ad5320bb54",
"event_fingerprint": "23dd8620e82dd7d29b08cc2b43d4905facc7c62e",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0567"
],
"matched_pattern_names": [
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0567"
],
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"method": "\u0005\u0001\u0000",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ac1aa659b2e04536eab5e1fb66970955700363b",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 22,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 22,
"scan_velocity_ports_per_s": 220,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9091 · KAFKA JMX
|
kafka-jmx
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9091
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a",
"emulator_response_len": 40,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "kafka-jmx",
"app_proto": "kafka-jmx",
"asn": 58224,
"country": "IR",
"dst_port": 9091,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "db6ff3adcc61fc267e01fe7df0cedfe8d1f51c6c",
"event_fingerprint": "ce2c4f2c3ed924aedc3da83d66dd2d0ca13b4808",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "kafka-jmx",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9091,
"service": "kafka-jmx",
"service_name": "kafka-jmx",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29ba50c8184ddfa648324148e5823b19e4f0ee88",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka-jmx",
"service_label_fr": "KAFKA JMX",
"dst_port": 9091,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-jmx",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_jmx",
"service_banner": "honeypot-kafka-jmx",
"service_os": "linux",
"dst_port": "9091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 23,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 23,
"scan_velocity_ports_per_s": 230,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
9999 · ADMIN ALT
|
admin-alt
|
Scan de ports
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9999
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Upstream
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Iran Telecommunication Company PJS",
"service": "admin-alt",
"app_proto": "admin-alt",
"asn": 58224,
"country": "IR",
"dst_port": 9999,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3a9bc78674850dbbea1d8ebbdceec7559985457b",
"event_fingerprint": "2cfee02dc5cd3fc25c2a80133168adbf503e7198",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 196,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "admin-alt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 58224,
"org": "Iran Telecommunication Company PJS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9999,
"service": "admin-alt",
"service_name": "admin-alt",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cacd99f150ec4f5e7192cdb8960bdd41f0dae62d",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "admin-alt",
"service_label_fr": "ADMIN ALT",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-admin-alt",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "admin_alt",
"service_banner": "honeypot-admin-alt",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 24,
"port_scan_ports_sample": [
1080,
1081,
1082,
1083,
1084,
1085,
1086,
1087,
1088,
1089,
3128,
8000,
8002,
8080,
8081,
8082
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 24,
"scan_velocity_ports_per_s": 240,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|