|
|
TCP |
8080 · HTTP
|
http
|
slowloris
slowloris · via HTTP:8080 · (tentative d'exploit) · → RXBn{Pk
|
Élevée
|
Faible · 39
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
RXBn{Pk
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
net_slowloris
net_web_probe
Cible HTTP
RXBn{Pk
TLS SNI
—
Capteur
paris-1
|
Méthode
Port
8080
Chemin / cible
RXBn{Pk
Pourquoi cette classification : Type « slowloris » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 39
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
RXBn{Pk HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��
��R�X���B�n�{�Pk ��n��mq ��}�� ��ފ�aF;�{�2���� � ���� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �� ��R�X���B�n�{�Pk ��n��mq ��}�� ��ފ�aF;�{�2���� � ���� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "7900a478452ac6b22a7c34695ffc3d82f201527b",
"http_referer_hash": null,
"http_method": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 413,
"payload_entropy": 5.946160028739637,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "GB",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 39,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9cd299e962b35aecbc71240c0346f5dedecfed21",
"event_fingerprint": "9b67d269cf92a9c8b9ed2467f131f0ac87c1fd7c",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 39,
"correlation_boost": 8
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "546430e9e4e20878635d8c0b455b273a",
"path_pattern_hash": "5aba74526280cd562b41279497ddbb17"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 39
},
"method": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002",
"path": "RX\u0003B\u0019n{Pk",
"request_line": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002 RX\u0003B\u0019n{Pk HTTP\/1.1",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\ufffd\ufffdR\ufffdX\ufffd\u0003\ufffd\ufffdB\u0019\ufffdn\ufffd{\ufffdPk \u0000\u0019\ufffd\ufffdn\ufffd\ufffdm\u0017q \ufffd\ufffd}\ufffd\ufffd\u001d \ufffd\ufffd\u078a\ufffda\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"method": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002",
"path": "RX\u0003B\u0019n{Pk",
"request_line": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002 RX\u0003B\u0019n{Pk HTTP\/1.1",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\ufffd\ufffdR\ufffdX\ufffd\u0003\ufffd\ufffdB\u0019\ufffdn\ufffd{\ufffdPk \u0000\u0019\ufffd\ufffdn\ufffd\ufffdm\u0017q \ufffd\ufffd}\ufffd\ufffd\u001d \ufffd\ufffd\u078a\ufffda\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\ufffd\ufffdR\ufffdX\ufffd\u0003\ufffd\ufffdB\u0019\ufffdn\ufffd{\ufffdPk \u0000\u0019\ufffd\ufffdn\ufffd\ufffdm\u0017q \ufffd\ufffd}\ufffd\ufffd\u001d \ufffd\ufffd\u078a\ufffda\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b33d6d6504ca4bc777df88fdbdd561a76930a53",
"protocol_details": {
"http_method": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002",
"http_path": "RX\u0003B\u0019n{Pk",
"request_line": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002 RX\u0003B\u0019n{Pk HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\r\ufffd\ufffdR\ufffdX\ufffd\ufffd\ufffdB\ufffdn\ufffd{\ufffdPk \ufffd\ufffdn\ufffd\ufffdmq \ufffd\ufffd}\ufffd\ufffd \ufffd\ufffd\u078a\ufffdaF;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 RX\u0003B\u0019n{Pk",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 39,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 39,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002",
"http_path": "RX\u0003B\u0019n{Pk",
"request_line": "\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002 RX\u0003B\u0019n{Pk HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 RX\u0003B\u0019n{Pk",
"evidence_snippet": "\ufffd\ufffd\ufffd\r\ufffd\ufffdR\ufffdX\ufffd\ufffd\ufffdB\ufffdn\ufffd{\ufffdPk \ufffd\ufffdn\ufffd\ufffdmq \ufffd\ufffd}\ufffd\ufffd \ufffd\ufffd\u078a\ufffdaF;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
slowloris
slowloris · via HTTP:8080 · (tentative d'exploit) · → 0D95ny{.ՌQg>KX0xg@
|
Élevée
|
Moyen · 40
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
v 0D95ny{.ՌQg>KX0xg@
Émulateur
HTTP
WAF
7
Recommandation
Surveiller
Tags
950324:rce-0
http_no_ua
net_slowloris
net_web_probe
Cible HTTP
v
0D95ny{.ՌQg>KX0xg@
TLS SNI
—
Capteur
paris-1
|
Méthode
v
Port
8080
Chemin / cible
0D95ny{.ՌQg>KX0xg@
Pourquoi cette classification : Type « slowloris » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
V 0D95ny{.ՌQg>KX0xg@ HTTP/1.1
User-Agent
—
Règles WAF
rce-0
Payload (extrait)
� �v �0��D95ny�{.�Ռ��Qg>K�X0�xg�@ �G��"-�F�h���d8Z�K� {h��
���F� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �v �0��D95ny�{.�Ռ��Qg>K�X0�xg�@ �G��"-�F�h���d8Z�K� {h�� ���F� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "\u057cqg>k\u0014x0xg@",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "3eb9e1f052b8d4e77e083763b3ba3bfbe065f672",
"http_referer_hash": null,
"http_method": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 416,
"payload_entropy": 5.932870283350434,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "GB",
"dst_port": 8080,
"risk_waf": 36,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 36,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5f0fc49105ee09e77f9b1bf446ecd909acfcf588",
"event_fingerprint": "02cf4a08912a2b143eef8eeedb9cb892cdeb0a7e",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 36,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d4762568c4e866052ba09bf040b7a013",
"path_pattern_hash": "c59fe6c20e1f48b5edb5f5acbc67e4dc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"method": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v",
"path": "0D95ny{.\u054cQg>K\u0014X0xg@",
"waf_tags": [
"950324:rce-0"
],
"waf_rule_names": [
"rce-0"
],
"request_line": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003V 0D95ny{.\u054cQg>K\u0014X0xg@ HTTP\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003v\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg>K\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\u0007\ufffd\"-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\u0000{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"method": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v",
"path": "0D95ny{.\u054cQg>K\u0014X0xg@",
"waf_tags": [
"950324:rce-0"
],
"waf_rule_names": [
"rce-0"
],
"request_line": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003V 0D95ny{.\u054cQg>K\u0014X0xg@ HTTP\/1.1",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003v\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg>K\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\u0007\ufffd\"-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\u0000{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003v\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg>K\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\u0007\ufffd\"-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\u0000{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a73d7a6d99d305ec2738483d0c50667fcea32b30",
"protocol_details": {
"http_method": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v",
"http_path": "0D95ny{.\u054cQg>K\u0014X0xg@",
"request_line": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003V 0D95ny{.\u054cQg>K\u0014X0xg@ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg>K\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\"-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 0D95ny{.\u054cQg>K\u0014X0xg@",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 36,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v",
"http_path": "0D95ny{.\u054cQg>K\u0014X0xg@",
"request_line": "\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003V 0D95ny{.\u054cQg>K\u0014X0xg@ HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 0D95ny{.\u054cQg>K\u0014X0xg@",
"evidence_snippet": "\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg>K\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\"-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950324:rce-0",
"http_no_ua",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �Y���!`:�o��-����%K.E�������` ���Rel�� 3M�L<�ɔ���G|��nq?�� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Y���!`:�o��-����%K.E�������` ���Rel�� 3M�L<�ɔ���G|��nq?�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �Y���!`:�o��-����%K.E�������` ���Rel�� 3M�L<�ɔ���G|��nq?�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 424,
"payload_entropy": 6.03426480738868,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d6f4e9dc7e0432435fc4661a569febb",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\u0017\ufffd-\ufffd\ufffd\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \u00123M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\u000e\ufffd\ufffdn\u0007q?\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\u0017\ufffd-\ufffd\ufffd\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \u00123M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\u000e\ufffd\ufffdn\u0007q?\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\u0017\ufffd-\ufffd\ufffd\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \u00123M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\u000e\ufffd\ufffdn\u0007q?\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fefe000a5f801c240ffb171f75d527b203e39999",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\u0017\ufffd-\ufffd\ufffd\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \u00123M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\u000e\ufffd\ufffdn\u0007q?\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffdY\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd 3M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\ufffd\ufffdnq?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\u0017\ufffd-\ufffd\ufffd\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \u00123M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\u000e\ufffd\ufffdn\u0007q?\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdY\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd 3M\ufffdL<\ufffd\u0254\ufffd\ufffd\ufffdG|\ufffd\ufffdnq?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
coap probe
coap probe · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
T P��M�˲ȹ�;`pQ���`�4�Ӧ+]�A>3 4��<:��T�@r��C/�Ko��&Az8��Zr �+ F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « coap_probe » (signaux protocolaires) · confiance 51%
Confiance classification
59%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 51 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0798
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma CoAP GET
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
T P��M�˲ȹ�;`pQ���`�4�Ӧ+]�A>3 4��<:��T�@r��C/�Ko��&Az8��Zr �+ F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P��M�˲ȹ�;`pQ���`�4�Ӧ+]�A>3 4��<:��T�@r��C/�Ko��&Az8��Zr �+ F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 345,
"payload_entropy": 6.072844458293377,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 60,
"precision_signals": [
"pat-0798"
],
"kb_rule_ids": [
"pat-0798"
],
"matched_patterns": [
"pat-0798",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Sigma CoAP GET",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0798",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "pharos",
"risk_confidence_factor": 51,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50be40c8290e21cef2a69226fcae31c8",
"path_pattern_hash": "2bc9f93b3f58e74e96efca118403941c"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0014\ufffd\ufffdM\u0002\ufffd\u02f2\u0239\ufffd;`\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\u0000\ufffd+\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0014\ufffd\ufffdM\u0002\ufffd\u02f2\u0239\ufffd;`\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\u0000\ufffd+\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0014\ufffd\ufffdM\u0002\ufffd\u02f2\u0239\ufffd;`\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\u0000\ufffd+\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbdcd289eb0fdd67827f3ea55c58bbeeae126ad9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0014\ufffd\ufffdM\u0002\ufffd\u02f2\u0239\ufffd;`\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\u0000\ufffd+\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "TP\ufffd\ufffdM\ufffd\u02f2\u0239\ufffd;`pQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\ufffd+F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "coap probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"classification_reason_label_fr": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0798"
],
"tags_summary_labels_fr": [
"pat-0798"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0014\ufffd\ufffdM\u0002\ufffd\u02f2\u0239\ufffd;`\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\u0000\ufffd+\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "coap probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd\ufffdM\ufffd\u02f2\u0239\ufffd;`pQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA>3 4\ufffd\ufffd<:\ufffd\ufffdT\ufffd@r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd&Az8\ufffd\ufffdZr\ufffd+F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
F B�Ay� j�{Y3&��v���wG8�A>��0� ~=ņ���z��u �V�ӳ1�=s%yH�k �� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�Ay� j�{Y3&��v���wG8�A>��0� ~=ņ���z��u �V�ӳ1�=s%yH�k �� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�Ay� j�{Y3&��v���wG8�A>��0� ~=ņ���z��u �V�ӳ1�=s%yH�k �� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 331,
"payload_entropy": 5.978402628812989,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e279ab35db0ec11cef1dc3067d5b7546",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdAy\ufffd\fj\ufffd{Y3&\ufffd\ufffd\u0012v\ufffd\u0015\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\u0013\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\u0004\u0005\ufffd\ufffdu\f\ufffdV\ufffd\u04f3\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdAy\ufffd\fj\ufffd{Y3&\ufffd\ufffd\u0012v\ufffd\u0015\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\u0013\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\u0004\u0005\ufffd\ufffdu\f\ufffdV\ufffd\u04f3\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdAy\ufffd\fj\ufffd{Y3&\ufffd\ufffd\u0012v\ufffd\u0015\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\u0013\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\u0004\u0005\ufffd\ufffdu\f\ufffdV\ufffd\u04f3\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bbfd4cdafb7976bdefaf0e3be1337c4f9e1178a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdAy\ufffd\fj\ufffd{Y3&\ufffd\ufffd\u0012v\ufffd\u0015\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\u0013\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\u0004\u0005\ufffd\ufffdu\f\ufffdV\ufffd\u04f3\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "FB\ufffdAy\ufffdj\ufffd{Y3&\ufffd\ufffdv\ufffd\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\ufffd ~=\u0146\ufffd\ufffd\ufffdz\ufffd\ufffdu\ufffdV\ufffd\u04f31\ufffd=s%yH\ufffdk \ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdAy\ufffd\fj\ufffd{Y3&\ufffd\ufffd\u0012v\ufffd\u0015\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\u0013\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\u0004\u0005\ufffd\ufffdu\f\ufffdV\ufffd\u04f3\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffdAy\ufffdj\ufffd{Y3&\ufffd\ufffdv\ufffd\ufffd\ufffdwG8\ufffdA>\ufffd\ufffd0\ufffd ~=\u0146\ufffd\ufffd\ufffdz\ufffd\ufffdu\ufffdV\ufffd\u04f31\ufffd=s%yH\ufffdk \ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �km �f2�*���l˺p�=S� ?�J�#� �� �xo ~ݡpԧf�����5$y&��hVƩl &� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �km �f2�*���l˺p�=S� ?�J�#� �� �xo ~ݡpԧf�����5$y&��hVƩl
&� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �km �f2�*���l˺p�=S� ?�J�#� �� �xo ~ݡpԧf�����5$y&��hVƩl &� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 412,
"payload_entropy": 5.923360733356842,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fc556d75938aa0b7877cae42d5a0b336",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003km\u001d\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\f?\ufffdJ\ufffd#\ufffd\u001c\ufffd\u0015\u0010\ufffd \ufffdxo\t~\u0761p\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\u0018\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003km\u001d\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\f?\ufffdJ\ufffd#\ufffd\u001c\ufffd\u0015\u0010\ufffd \ufffdxo\t~\u0761p\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\u0018\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003km\u001d\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\f?\ufffdJ\ufffd#\ufffd\u001c\ufffd\u0015\u0010\ufffd \ufffdxo\t~\u0761p\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\u0018\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "899e66959345f37aedb49db7dae778deb445cc6b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003km\u001d\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\f?\ufffdJ\ufffd#\ufffd\u001c\ufffd\u0015\u0010\ufffd \ufffdxo\t~\u0761p\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\u0018\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffdkm\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd?\ufffdJ\ufffd#\ufffd\ufffd\ufffd \ufffdxo\t~\u0761p\u0527f\ufffd\ufffd\ufffd\ufffd\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003km\u001d\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\f?\ufffdJ\ufffd#\ufffd\u001c\ufffd\u0015\u0010\ufffd \ufffdxo\t~\u0761p\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\u0018\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdkm\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd?\ufffdJ\ufffd#\ufffd\ufffd\ufffd \ufffdxo\t~\u0761p\u0527f\ufffd\ufffd\ufffd\ufffd\ufffd5$y&\ufffd\ufffdhV\u01a9l\n&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� ����5��( n��'�in��%��Y7KA�~�&' �� HtO2 $�9��&� GA�R j ��'�>� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����5��( n��'�in��%��Y7KA�~�&' �� HtO2 $�9��&� GA�R
j
��'�>� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����5��( n��'�in��%��Y7KA�~�&' �� HtO2 $�9��&� GA�R j ��'�>� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 413,
"payload_entropy": 6.024924597470011,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "689d0effbc517e2f5e0042843760355a",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0015\ufffd\ufffd\ufffd\u00175\ufffd\ufffd(\u0000n\ufffd\ufffd'\ufffd\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd\u000b HtO2\u001f$\ufffd9\ufffd\ufffd&\ufffd\u001cGA\ufffdR\rj\r\ufffd\ufffd\u0015'\ufffd>\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0015\ufffd\ufffd\ufffd\u00175\ufffd\ufffd(\u0000n\ufffd\ufffd'\ufffd\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd\u000b HtO2\u001f$\ufffd9\ufffd\ufffd&\ufffd\u001cGA\ufffdR\rj\r\ufffd\ufffd\u0015'\ufffd>\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0015\ufffd\ufffd\ufffd\u00175\ufffd\ufffd(\u0000n\ufffd\ufffd'\ufffd\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd\u000b HtO2\u001f$\ufffd9\ufffd\ufffd&\ufffd\u001cGA\ufffdR\rj\r\ufffd\ufffd\u0015'\ufffd>\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b54cb634b35274383ceae5bb63ee18e51a8e9368",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0015\ufffd\ufffd\ufffd\u00175\ufffd\ufffd(\u0000n\ufffd\ufffd'\ufffd\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd\u000b HtO2\u001f$\ufffd9\ufffd\ufffd&\ufffd\u001cGA\ufffdR\rj\r\ufffd\ufffd\u0015'\ufffd>\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd(n\ufffd\ufffd'\ufffdin\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd HtO2$\ufffd9\ufffd\ufffd&\ufffdGA\ufffdR\rj\r\ufffd\ufffd'\ufffd>\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0015\ufffd\ufffd\ufffd\u00175\ufffd\ufffd(\u0000n\ufffd\ufffd'\ufffd\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd\u000b HtO2\u001f$\ufffd9\ufffd\ufffd&\ufffd\u001cGA\ufffdR\rj\r\ufffd\ufffd\u0015'\ufffd>\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd(n\ufffd\ufffd'\ufffdin\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd&' \ufffd\ufffd HtO2$\ufffd9\ufffd\ufffd&\ufffdGA\ufffdR\rj\r\ufffd\ufffd'\ufffd>\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �W�UdL�iK��\��IfD��h�'C'�r ��J�� �g����� D�f]|ְHdwis86�=i� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �W�UdL�iK��\��IfD��h�'C'�r ��J�� �g����� D�f]|ְHdwis86�=i� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �W�UdL�iK��\��IfD��h�'C'�r ��J�� �g����� D�f]|ְHdwis86�=i� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 426,
"payload_entropy": 5.9543850910122265,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a61cc7e27b54eaeb92f5ef66ec1cb8a0",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\u001e\ufffd\ufffdJ\ufffd\ufffd\t \u001f\ufffdg\ufffd\ufffd\u0014\u0019\ufffd\ufffd\ufffd\u0000D\ufffdf]|\u05b0Hd\u001aw\u0007is8\u001b6\ufffd=i\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\u001e\ufffd\ufffdJ\ufffd\ufffd\t \u001f\ufffdg\ufffd\ufffd\u0014\u0019\ufffd\ufffd\ufffd\u0000D\ufffdf]|\u05b0Hd\u001aw\u0007is8\u001b6\ufffd=i\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\u001e\ufffd\ufffdJ\ufffd\ufffd\t \u001f\ufffdg\ufffd\ufffd\u0014\u0019\ufffd\ufffd\ufffd\u0000D\ufffdf]|\u05b0Hd\u001aw\u0007is8\u001b6\ufffd=i\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bbee49d1e6d26c5c52c7652996cd8a1c187251b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\u001e\ufffd\ufffdJ\ufffd\ufffd\t \u001f\ufffdg\ufffd\ufffd\u0014\u0019\ufffd\ufffd\ufffd\u0000D\ufffdf]|\u05b0Hd\u001aw\u0007is8\u001b6\ufffd=i\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffdW\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\ufffd\ufffdJ\ufffd\ufffd\t \ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdf]|\u05b0Hdwis86\ufffd=i\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\u001e\ufffd\ufffdJ\ufffd\ufffd\t \u001f\ufffdg\ufffd\ufffd\u0014\u0019\ufffd\ufffd\ufffd\u0000D\ufffdf]|\u05b0Hd\u001aw\u0007is8\u001b6\ufffd=i\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdW\ufffdUdL\ufffdiK\ufffd\ufffd\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd'C'\ufffdr\ufffd\ufffdJ\ufffd\ufffd\t \ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdf]|\u05b0Hdwis86\ufffd=i\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �YJ��lE���� ����Q�ɒ��:�ŭX��"G !�S����t�S�� 1S I�I�qjش�v�� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �YJ��lE���� ����Q�ɒ��:�ŭX��"G
!�S����t�S�� 1S
I�I�qjش�v�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �YJ��lE���� ����Q�ɒ��:�ŭX��"G !�S����t�S�� 1S I�I�qjش�v�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 426,
"payload_entropy": 6.048807811218793,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "740fde2f2ec32b2d4dde34ca34316163",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0013\u0252\ufffd\ufffd:\ufffd\u016d\u0016X\ufffd\ufffd\"G \n!\ufffdS\ufffd\u0015\ufffd\ufffd\ufffdt\ufffd\u000fS\ufffd\ufffd\f1S\nI\ufffdI\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0013\u0252\ufffd\ufffd:\ufffd\u016d\u0016X\ufffd\ufffd\"G \n!\ufffdS\ufffd\u0015\ufffd\ufffd\ufffdt\ufffd\u000fS\ufffd\ufffd\f1S\nI\ufffdI\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0013\u0252\ufffd\ufffd:\ufffd\u016d\u0016X\ufffd\ufffd\"G \n!\ufffdS\ufffd\u0015\ufffd\ufffd\ufffdt\ufffd\u000fS\ufffd\ufffd\f1S\nI\ufffdI\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9fcc2234ab5b6bd0a08f85f9737fa7d077af8b79",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0013\u0252\ufffd\ufffd:\ufffd\u016d\u0016X\ufffd\ufffd\"G \n!\ufffdS\ufffd\u0015\ufffd\ufffd\ufffdt\ufffd\u000fS\ufffd\ufffd\f1S\nI\ufffdI\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffdYJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0252\ufffd\ufffd:\ufffd\u016dX\ufffd\ufffd\"G \n!\ufffdS\ufffd\ufffd\ufffd\ufffdt\ufffdS\ufffd\ufffd1S\nI\ufffdI\ufffdqj\u0634\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0013\u0252\ufffd\ufffd:\ufffd\u016d\u0016X\ufffd\ufffd\"G \n!\ufffdS\ufffd\u0015\ufffd\ufffd\ufffdt\ufffd\u000fS\ufffd\ufffd\f1S\nI\ufffdI\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdYJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0252\ufffd\ufffd:\ufffd\u016dX\ufffd\ufffd\"G \n!\ufffdS\ufffd\ufffd\ufffd\ufffdt\ufffdS\ufffd\ufffd1S\nI\ufffdI\ufffdqj\u0634\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� ��~� bE���gPD����%ҧ���H/.C۬� -�8]~���v`m� �c �="�i��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��~� bE���gPD����%ҧ���H/.C۬� -�8]~���v`m� �c
�="�i��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��~� bE���gPD����%ҧ���H/.C۬� -�8]~���v`m� �c �="�i��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 416,
"payload_entropy": 5.961164753142381,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c7b494d9fe2332b4ac22bf134fb15113",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\u000f\ufffd%\u04a7\ufffd\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\u0011\u001d\ufffdc\n\ufffd=\"\ufffdi\ufffd\u0005\u0005\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\u000f\ufffd%\u04a7\ufffd\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\u0011\u001d\ufffdc\n\ufffd=\"\ufffdi\ufffd\u0005\u0005\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\u000f\ufffd%\u04a7\ufffd\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\u0011\u001d\ufffdc\n\ufffd=\"\ufffdi\ufffd\u0005\u0005\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54140fe5ce1d39b5e1e87245d074ab675c4e4caf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\u000f\ufffd%\u04a7\ufffd\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\u0011\u001d\ufffdc\n\ufffd=\"\ufffdi\ufffd\u0005\u0005\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd~\ufffdbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\ufffd%\u04a7\ufffd\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\ufffdc\n\ufffd=\"\ufffdi\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd~\ufffd\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\u000f\ufffd%\u04a7\ufffd\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\u0011\u001d\ufffdc\n\ufffd=\"\ufffdi\ufffd\u0005\u0005\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd~\ufffdbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\ufffd%\u04a7\ufffd\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\ufffdc\n\ufffd=\"\ufffdi\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �-�L�9 �݄�ݬX�빘y� �o��� �ӠI �N�RB ѵ"�� � �����\�/�{��g> �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �-�L�9 �݄�ݬX�빘y� �o��� �ӠI �N�RB ѵ"�� �
�����\�/�{��g> �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �-�L�9 �݄�ݬX�빘y� �o��� �ӠI �N�RB ѵ"�� � �����\�/�{��g> �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �jj 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 439,
"payload_entropy": 5.975688004023673,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9039c89d9191db5d1358afc7953c909c",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0017-\ufffdL\u0015\ufffd9\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0001\u001d\u0475\"\u0018\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\u0012\ufffdg\u0019>\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0017-\ufffdL\u0015\ufffd9\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0001\u001d\u0475\"\u0018\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\u0012\ufffdg\u0019>\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdjj\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0017-\ufffdL\u0015\ufffd9\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0001\u001d\u0475\"\u0018\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\u0012\ufffdg\u0019>\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c815a2ee1eb92854c2e5076b5d7108264da6ce9a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0017-\ufffdL\u0015\ufffd9\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0001\u001d\u0475\"\u0018\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\u0012\ufffdg\u0019>\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd-\ufffdL\ufffd9\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0475\"\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\ufffdg>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0017-\ufffdL\u0015\ufffd9\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0001\u001d\u0475\"\u0018\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\u0012\ufffdg\u0019>\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd-\ufffdL\ufffd9\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0475\"\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\/\ufffd{\ufffd\ufffdg>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
Sonde PostgreSQL
postgres probe · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� ���e�����O 8wb�<�k��~st�#�5�U ������_ i����?�ܪ��o3�$�l? 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���e�����O 8wb�<�k��~st�#�5�U ������_ i����?�ܪ��o3�$�l? 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� ���e�����O 8wb�<�k��~st�#�5�U ������_ i����?�ܪ��o3�$�l? 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� [ � � 2 + 3��������J
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1503,
"payload_entropy": 7.703674844657129,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "pharos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "832488a70179479dfef823497eb7f82b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\bO\u0000\u0010\u0002\u00138wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd_\u0000\u0015\u001ai\ufffd\ufffd\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\u0003\u0001\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\bO\u0000\u0010\u0002\u00138wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd_\u0000\u0015\u001ai\ufffd\ufffd\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\u0003\u0001\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffdJ",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\bO\u0000\u0010\u0002\u00138wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd_\u0000\u0015\u001ai\ufffd\ufffd\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\u0003\u0001\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61eb55e3eb3b3aca71d87edc519414b2910e1e01",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\bO\u0000\u0010\u0002\u00138wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd_\u0000\u0015\u001ai\ufffd\ufffd\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\u0003\u0001\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffdO8wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_i\ufffd\ufffd\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\bO\u0000\u0010\u0002\u00138wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\u0015\ufffd\ufffd\ufffd_\u0000\u0015\u001ai\ufffd\ufffd\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\u0003\u0001\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffdO8wb\ufffd<\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_i\ufffd\ufffd\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
Sonde PostgreSQL
postgres probe · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� ��td�s��x0k�O�X6�:�a�o�8��,�� �W�6�Y����Ջq K��q��)�n �P � [ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��td�s��x0k�O�X6�:�a�o�8��,�� �W�6�Y����Ջq K��q��)�n �P � [ �
�
Requête brute (extrait)
� ��td�s��x0k�O�X6�:�a�o�8��,�� �W�6�Y����Ջq K��q��)�n �P � [ � � 2 + 3����۫|�d>c�W+T.@| ?��7zW�8�q�Z�?*\�{c@��f� 9�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1459,
"payload_entropy": 7.747144536494951,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "pharos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a12816b34a1b7044862c972b37e26cb",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdtd\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\u0017:\ufffda\ufffd\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\u001b\ufffd6\ufffdY\ufffd\ufffd\u0006\ufffd\ufffd\u054bq\u000b\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\u0018n\u001f\ufffdP\u001e\ufffd\u0000\u0006\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdtd\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\u0017:\ufffda\ufffd\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\u001b\ufffd6\ufffdY\ufffd\ufffd\u0006\ufffd\ufffd\u054bq\u000b\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\u0018n\u001f\ufffdP\u001e\ufffd\u0000\u0006\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u06eb|\u0019\ufffdd>c\ufffdW+T.@|\r ?\ufffd\u0010\ufffd7zW\ufffd8\ufffdq\ufffdZ\ufffd\u0018?*\\\ufffd{c@\u0007\b\u0003\ufffd\ufffdf\ufffd\u001c9\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdtd\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\u0017:\ufffda\ufffd\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\u001b\ufffd6\ufffdY\ufffd\ufffd\u0006\ufffd\ufffd\u054bq\u000b\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\u0018n\u001f\ufffdP\u001e\ufffd\u0000\u0006\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce17b7c625c9ee6e747c514d1db6869db56336ca",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdtd\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\u0017:\ufffda\ufffd\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\u001b\ufffd6\ufffdY\ufffd\ufffd\u0006\ufffd\ufffd\u054bq\u000b\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\u0018n\u001f\ufffdP\u001e\ufffd\u0000\u0006\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdtd\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd:\ufffda\ufffdo\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\ufffd6\ufffdY\ufffd\ufffd\ufffd\ufffd\u054bqK\ufffd\ufffdq\ufffd\ufffd)\ufffdn\ufffdP\ufffd[\ufffd\n\n\ufffd",
"attack_vector": "postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdtd\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\u0017:\ufffda\ufffd\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\u001b\ufffd6\ufffdY\ufffd\ufffd\u0006\ufffd\ufffd\u054bq\u000b\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\u0018n\u001f\ufffdP\u001e\ufffd\u0000\u0006\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdtd\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd:\ufffda\ufffdo\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\ufffd6\ufffdY\ufffd\ufffd\ufffd\ufffd\u054bqK\ufffd\ufffdq\ufffd\ufffd)\ufffdn\ufffdP\ufffd[\ufffd\n\n\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4443 · PHAROS
|
pharos
|
pharos
pharos · via PHAROS:4443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
PHAROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4443
Chemin / cible
—
Service
PHAROS
Payload
� �����/�����z�M��cM�<6���UE�+d֟ H�39%�� �K�醳$Z���e}����F\+ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « pharos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����/�����z�M��cM�<6���UE�+d֟ H�39%��
�K�醳$Z���e}����F\+ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �����/�����z�M��cM�<6���UE�+d֟ H�39%�� �K�醳$Z���e}����F\+ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 424,
"payload_entropy": 5.979770105871638,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "pharos",
"app_proto": "pharos",
"asn": 14061,
"country": "GB",
"dst_port": 4443,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c69c7f867cbde1fc45845bf5a044a153ed44af02",
"event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "pharos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "117509bcba715ffb1cacec3c17ea499a",
"path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
},
"target_context": {
"dst_port": 4443,
"service": "pharos",
"service_name": "pharos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u0018\u001a<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\u0015\ufffd\ufffd\ufffd\u0001e}\ufffd\ufffd\ufffd\ufffdF\\+\u001e\u0006\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u0018\u001a<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\u0015\ufffd\ufffd\ufffd\u0001e}\ufffd\ufffd\ufffd\ufffdF\\+\u001e\u0006\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u0018\u001a<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\u0015\ufffd\ufffd\ufffd\u0001e}\ufffd\ufffd\ufffd\ufffdF\\+\u001e\u0006\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "04aee9191bbbc950ed96d69642648c7024cc7af2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u0018\u001a<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\u0015\ufffd\ufffd\ufffd\u0001e}\ufffd\ufffd\ufffd\ufffdF\\+\u001e\u0006\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\ufffd\ufffd\ufffde}\ufffd\ufffd\ufffd\ufffdF\\+\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "pharos",
"service_label_fr": "PHAROS",
"dst_port": 4443,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pharos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u0018\u001a<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\u0015\ufffd\ufffd\ufffd\u0001e}\ufffd\ufffd\ufffd\ufffdF\\+\u001e\u0006\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 4443,
"service": "pharos",
"service_label_fr": "PHAROS"
},
"attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd<6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\r\ufffdK\ufffd\u91b3$Z\ufffd\ufffd\ufffde}\ufffd\ufffd\ufffd\ufffdF\\+\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "4443 \u00b7 PHAROS",
"emulator_service": "pharos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pharos",
"service_banner": "honeypot-pharos",
"service_os": "linux",
"dst_port": "4443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8080 · HTTP
|
http
|
stun probe
stun probe · via HTTP:8080 · (sonde / probe) · → -hv4-
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
tu_] -hv4-
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
net_web_probe
Cible HTTP
tu_]
-hv4-
TLS SNI
—
Capteur
paris-1
|
Méthode
tu_]
Port
8080
Chemin / cible
-hv4-
Pourquoi cette classification : Type « stun_probe » (signaux protocolaires) · confiance 44%
Confiance classification
52%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 44 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
Ligne de requête
TU_] -hv4- HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���t�u���_��]�� �� �-��h��v�4- lO֤�|�(� k-C�W� ۭA�Op.!�W% � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���t�u���_��]�� �� �-��h��v�4- lO֤�|�(� k-C�W� ۭA�Op.!�W% � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "858555a88e5b068d0dde4e1349d4ee2ff3c28238",
"http_referer_hash": null,
"http_method": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 424,
"payload_entropy": 5.976736007988104,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "GB",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "419e4ac29452b92a185dedfa84ffda7030a25df9",
"event_fingerprint": "e674a36cd19c443097e00238452553703c83c5aa",
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 52,
"precision_signals": [
"pat-0771"
],
"kb_rule_ids": [
"pat-0771"
],
"matched_patterns": [
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 44,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5cd19bf29227c9ef5f47de0704388518",
"path_pattern_hash": "ea5e3b9f8c39750094408f2b7293d1b2"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"method": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017",
"path": "-hv4-",
"request_line": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003TU_]\u0010\u0017 -hv4- HTTP\/1.1",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\u0010\u0017\ufffd\u001f\ufffd\ufffd\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\u0015-C\ufffdW\ufffd\u001f\u06edA\ufffdO\b\u001ap.!\ufffdW%\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"method": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017",
"path": "-hv4-",
"request_line": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003TU_]\u0010\u0017 -hv4- HTTP\/1.1",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\u0010\u0017\ufffd\u001f\ufffd\ufffd\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\u0015-C\ufffdW\ufffd\u001f\u06edA\ufffdO\b\u001ap.!\ufffdW%\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\u0010\u0017\ufffd\u001f\ufffd\ufffd\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\u0015-C\ufffdW\ufffd\u001f\u06edA\ufffdO\b\u001ap.!\ufffdW%\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94f7bbd8c3c5d18c16070d9518c42b90ff1d21ee",
"protocol_details": {
"http_method": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017",
"http_path": "-hv4-",
"request_line": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003TU_]\u0010\u0017 -hv4- HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k-C\ufffdW\ufffd\u06edA\ufffdOp.!\ufffdW%\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "stun probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 -hv4-",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 44 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"classification_reason_label_fr": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017",
"http_path": "-hv4-",
"request_line": "\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003TU_]\u0010\u0017 -hv4- HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "stun probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 -hv4-",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k-C\ufffdW\ufffd\u06edA\ufffdOp.!\ufffdW%\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 44 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"pharos"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|