Renseignement sur les menaces

Italie

212.102.54.136

FAI Datacamp Limited Première vue 18/06/2026 16:10 UTC Dernière vue 18/06/2026 17:14 UTC Risque Moyen

Période analysée : 2026-05-19 → 2026-06-18

Activité suspecte — risque 35/100 (Faible) — MITRE TA0011 — confiance 72 % — via RTSP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 47/100 Moyen

Première observation 18/06/2026 16:10 UTC

Dernière observation 18/06/2026 17:14 UTC

Événements (période) 1,432

MITRE ATT&CK principal TA0007 1294 occurrences

Activité suspecte — risque 35/100 (Faible) — MITRE TA0011 — confiance 72 % — via RTSP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « tor_exit_probe » (signaux protocolaires) · confiance 72%

Confiance 72 % — Score WAF 8

Comparaison ASN / FAI

ASN 60068 · 212.102.54.0/23 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,432 événements sur la période pour cette IP.

87.249.133.84 Sonde Memcached 18/06/2026 18:44 UTC
149.88.101.10 cpanel probe 17/06/2026 22:28 UTC
146.103.45.183 Sonde PostgreSQL 17/06/2026 10:19 UTC
178.157.94.250 Sonde port 23/TCP 16/06/2026 18:34 UTC
149.88.21.150 vnc bruteforce 15/06/2026 22:48 UTC
149.88.21.148 Sonde port 5902/TCP 15/06/2026 11:52 UTC
149.40.53.5 vnc bruteforce 15/06/2026 08:02 UTC
169.150.203.249 vnc bruteforce 15/06/2026 07:52 UTC

Événements (filtres)

1,432

Première observation

18/06/2026 16:10 UTC

Dernière observation

18/06/2026 17:14 UTC

Dernière activité (filtres)

18/06/2026 17:14 UTC

Événements 7j

1,432

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Italie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Datacamp Limited 0 Port 554 rtsp_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Commande & contrôle

Chaîne d'attaque

Commande & contrôle

Vecteur d'attaque

tor exit probe · via RTSP:554 · (commande & contrôle)

Détails protocole

Aperçu payload

OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100

Port / service

554 · RTSP

Service émulé

RTSP

Raison confiance

Confiance 72 % — 3 signal(aux) capteur

Technique MITRE

TA0011

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

Tor Exit Hint Upstream

Confiance

72%

Famille de menace

botnet

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

1,432 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1432 événement(s) — page 1/29

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/06/2026 17:14:15 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/onvif-http/snapshot?auth=YWRtaW46MTEK RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/onvif-http/snapshot?auth=YWRtaW46MTEK RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 116, "payload_entropy": 5.302639267326606, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "28ccc44adb90ca5b425fe5163af486f3", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "848f551a9035f441debd6c3305805fcf287daf93", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:15 UTC	TCP	554 · RTSP	rtsp	tor exit probe tor exit probe · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_tor_exit_probe rtsp_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 72% Confiance classification 72% Risque capteur Faible · 35 Confiance : Confiance 72 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Upstream Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 114, "payload_entropy": 5.2932141942290265, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ede49e53004f29a4185d68116b64086c80bfc558", "event_fingerprint": "96ba8353a2e0c3ee9bf071a6762ce711536fe8ff", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "confidence": 0.72, "classification_confidence": 0.72, "precision_score": 80, "precision_signals": [ "INT-TOR-exit-hint", "INT-upstream" ], "kb_rule_ids": [ "INT-TOR-exit-hint", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 72, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c3c5d2ed787bbdb0ffdfcb271929f7c", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 35 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b6cf2789ebaed86156f021e06d0bed8f87722879", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 72 % \u2014 via RTSP", "confidence_pct": 72, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint", "INT-upstream" ], "tags_summary_labels_fr": [ "Tor Exit Hint", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "rtsp_probe", "tor_exit_probe" ] }
18/06/2026 17:14:14 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/video0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/video0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 85, "payload_entropy": 4.997166230051728, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "090d1ff3008b8db032fd3a87ce5a4464", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b5166188a0f81c7032c60b8d9ea72244f614b26", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:14 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1/main RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1/main RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 92, "payload_entropy": 5.053362162946347, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "319b2a3daf589cab18975b479da48606", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df956ff742173b52a62f3fe1940af97eb5012548", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:14 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/videoMain RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/videoMain RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 88, "payload_entropy": 5.071488829007554, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a879703820cf460d45518b6be4a57db6", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "587522b0043074b3899a9f0354b84819fd0ee573", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/2 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/2 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 80, "payload_entropy": 4.910754932517597, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b762c0168951107288c309a72f3ab407", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a308ae74e846ed86409f2466da7e85998dacdb0c", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 87, "payload_entropy": 4.979055605776413, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "15a7c41d381e2b82b7717741b6680751", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "def9bfbc7df17bf42239710eeb16b6eeee40d57a", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/mpeg4 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/mpeg4 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 84, "payload_entropy": 4.962091643166646, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3192bd83cf1bcda052e9aa023bb7fe6f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0eb9dfa620aecc01c2b2d6f9d0762d91852dc234", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 80, "payload_entropy": 4.88700325089397, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e92303d1f319048f4a68d0dae3e22601", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "16ae521b42319c837fd9a6f3518b4fe70bff8bbb", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	tor exit probe tor exit probe · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_tor_exit_probe rtsp_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 72% Confiance classification 72% Risque capteur Faible · 35 Confiance : Confiance 72 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Upstream Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 114, "payload_entropy": 5.2932141942290265, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ede49e53004f29a4185d68116b64086c80bfc558", "event_fingerprint": "96ba8353a2e0c3ee9bf071a6762ce711536fe8ff", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "confidence": 0.72, "classification_confidence": 0.72, "precision_score": 80, "precision_signals": [ "INT-TOR-exit-hint", "INT-upstream" ], "kb_rule_ids": [ "INT-TOR-exit-hint", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 72, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c5df0bc6b19e0a90acedf64ef8611e5", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 35 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "531658c8d2cea2e627a38f089abb8aaac4cef7da", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 72 % \u2014 via RTSP", "confidence_pct": 72, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint", "INT-upstream" ], "tags_summary_labels_fr": [ "Tor Exit Hint", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "rtsp_probe", "tor_exit_probe" ] }
18/06/2026 17:14:13 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 83, "payload_entropy": 4.951678401378039, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5acfae6c06317359f6eea7986360e327", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "14bf971619419bdb9b366480de06381f69d21cdc", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:12 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 82, "payload_entropy": 4.961167937983721, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a3d2ec127fd1928e6c34e11f3325dc6c", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c57614ff14c706a22ca3ca395bd866fe9bf1803f", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:12 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 99, "payload_entropy": 5.05991966182411, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2b2b139cf820f4099397c5ab6755c82e", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "addd9632c9dc077d8a1d9bd5bb66832941a11cb9", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:11 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/1/h264major RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/1/h264major RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 90, "payload_entropy": 5.04615160812462, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e755c363b97e479b2f8c6e7a39fd05d4", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "231f7b1be9223a57d359c819304028c4eef38736", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:10 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/stream1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/stream1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 86, "payload_entropy": 4.937738377163204, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c70feef3acd3eef48b3e86c83e96243f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ada362ddce67ae574fe79e85e54d312f60228af", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:10 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 82, "payload_entropy": 4.957625327551364, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a86847dc45cf5418811a12536a0fed17", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fee4d2f4fe2ca1db9cc698363acc8aad85283ec", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:09 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 85, "payload_entropy": 4.954699871528942, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d993b37fa06054e08477985f1c0d131b", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a717780e5633439848bf3a3f6c39df38d7b231e", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:09 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 83, "payload_entropy": 4.975774786920208, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "665d6713227d2a0cb505d2c90c40c9d9", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb773b1c9071055b8132b7e94779c892ed5c8312", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:09 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 84, "payload_entropy": 4.963280517810811, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cce398c859cdf2f4a02f498a93e950b9", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66b97ca11f3ca6605c0d4c5750f89ffb757060e6", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:08 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1/sub/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1/sub/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 101, "payload_entropy": 5.104648458785605, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e4c872925138177abfc7b2d3fd3da0c0", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf659918a9a505d417260f9a35ebce8a11cc7c71", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:08 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/streaming/channels/101 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/streaming/channels/101 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 101, "payload_entropy": 5.045013928228139, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "80296506cdb482e24f9ac4bb1d25bcb3", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4aaa0a9e83b49351ea86effff42b465194b76ee", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:08 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 90, "payload_entropy": 5.007154108076543, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3dffc8615349282b81540f0750bd83ad", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56ab23b8eacb14670d82bf5b77b07ec8dac36df9", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:08 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/ch00_0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/ch00_0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 90, "payload_entropy": 5.023642368691698, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9e83680164253a0d2f90560d4c0d7096", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c839dd8a3637a1cfd8a3720c41014ac2cefe39a3", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:08 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch1/main/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch1/main/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 97, "payload_entropy": 5.079056723912164, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e04209eff65155360fa282e16785674d", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "96ceb44f848da1228da3c13daebc76f0927488dc", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1\/main\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:07 UTC	TCP	554 · RTSP	rtsp	tor exit probe tor exit probe · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_tor_exit_probe rtsp_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP/1.0 CSeq: 1 User-Agent: Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 72% Confiance classification 72% Risque capteur Faible · 35 Confiance : Confiance 72 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Upstream Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP/1.0 CSeq: 1 User-Agent: Requête brute (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 146, "payload_entropy": 5.533921309358104, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ede49e53004f29a4185d68116b64086c80bfc558", "event_fingerprint": "96ba8353a2e0c3ee9bf071a6762ce711536fe8ff", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "confidence": 0.72, "classification_confidence": 0.72, "precision_score": 80, "precision_signals": [ "INT-TOR-exit-hint", "INT-upstream" ], "kb_rule_ids": [ "INT-TOR-exit-hint", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 72, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c9c41870c7059b04919948fddefbb725", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 35 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f0fd35e9714512a381444f65c146563350886f33", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 72 % \u2014 via RTSP", "confidence_pct": 72, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint", "INT-upstream" ], "tags_summary_labels_fr": [ "Tor Exit Hint", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=00&authbasic=ZGVmYXVsdDp0bHVhZmVk RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "rtsp_probe", "tor_exit_probe" ] }
18/06/2026 17:14:07 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 87, "payload_entropy": 5.021693605139019, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4e4794cde01cf81eecded7403f58bb06", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b7c0670e7717aabe7f0ab633aae49b4133dc3981", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:07 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 88, "payload_entropy": 4.97849390366616, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a65416c01bf5a161feca0bf098936c5f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34432622514899f33516a77e698a70a2c77d7df8", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:07 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 80, "payload_entropy": 4.890634426587137, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0ffdd962f72e060eadf81b6804ea1d14", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ff9df1b1057a91e68d82cc7c91299f2dd267df0", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:07 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/rtsp_live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/rtsp_live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 89, "payload_entropy": 5.011646211597882, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "55691ffef0006ab780ec7fbe16563949", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "398ad9140a84c48fea52261b620841924ac9c19e", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/rtsp_live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:06 UTC	TCP	554 · RTSP	rtsp	tor exit probe tor exit probe · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_tor_exit_probe rtsp_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 72% Confiance classification 72% Risque capteur Faible · 35 Confiance : Confiance 72 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Upstream Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 114, "payload_entropy": 5.2932141942290265, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ede49e53004f29a4185d68116b64086c80bfc558", "event_fingerprint": "96ba8353a2e0c3ee9bf071a6762ce711536fe8ff", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "confidence": 0.72, "classification_confidence": 0.72, "precision_score": 80, "precision_signals": [ "INT-TOR-exit-hint", "INT-upstream" ], "kb_rule_ids": [ "INT-TOR-exit-hint", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 72, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c3c5d2ed787bbdb0ffdfcb271929f7c", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 35 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b6cf2789ebaed86156f021e06d0bed8f87722879", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 72 % \u2014 via RTSP", "confidence_pct": 72, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint", "INT-upstream" ], "tags_summary_labels_fr": [ "Tor Exit Hint", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "rtsp_probe", "tor_exit_probe" ] }
18/06/2026 17:14:06 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 83, "payload_entropy": 4.951678401378039, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5acfae6c06317359f6eea7986360e327", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "14bf971619419bdb9b366480de06381f69d21cdc", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:06 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 79, "payload_entropy": 4.900061090081141, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8bf317a0a8524b4b7022e6774105a2a6", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0069c67a7504c57b5eca7421fdeebd26e4557710", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:06 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 85, "payload_entropy": 4.945818842091725, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "db4a4ea9235abd927d8902a33d2527fe", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a8e211758d7c99e37259d9259d198c5379aca0e7", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:05 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/onvif-http/snapshot?auth=YWRtaW46MTEK RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/onvif-http/snapshot?auth=YWRtaW46MTEK RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 116, "payload_entropy": 5.302639267326606, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "28ccc44adb90ca5b425fe5163af486f3", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "848f551a9035f441debd6c3305805fcf287daf93", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/onvif-http\/snapshot?auth=YWRtaW46MTEK RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:05 UTC	TCP	554 · RTSP	rtsp	tor exit probe tor exit probe · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_tor_exit_probe rtsp_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 72% Confiance classification 72% Risque capteur Faible · 35 Confiance : Confiance 72 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Upstream Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 114, "payload_entropy": 5.2932141942290265, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ede49e53004f29a4185d68116b64086c80bfc558", "event_fingerprint": "96ba8353a2e0c3ee9bf071a6762ce711536fe8ff", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "confidence": 0.72, "classification_confidence": 0.72, "precision_score": 80, "precision_signals": [ "INT-TOR-exit-hint", "INT-upstream" ], "kb_rule_ids": [ "INT-TOR-exit-hint", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 72, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c5df0bc6b19e0a90acedf64ef8611e5", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 35 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "531658c8d2cea2e627a38f089abb8aaac4cef7da", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 72%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 72 % \u2014 via RTSP", "confidence_pct": 72, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint", "INT-upstream" ], "tags_summary_labels_fr": [ "Tor Exit Hint", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "tor exit probe \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 72 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "rtsp_probe", "tor_exit_probe" ] }
18/06/2026 17:14:05 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/1/h264major RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/1/h264major RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 90, "payload_entropy": 5.04615160812462, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e755c363b97e479b2f8c6e7a39fd05d4", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "231f7b1be9223a57d359c819304028c4eef38736", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:05 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/video0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/video0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 85, "payload_entropy": 4.997166230051728, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "090d1ff3008b8db032fd3a87ce5a4464", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b5166188a0f81c7032c60b8d9ea72244f614b26", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/video0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:05 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 80, "payload_entropy": 4.88700325089397, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e92303d1f319048f4a68d0dae3e22601", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "16ae521b42319c837fd9a6f3518b4fe70bff8bbb", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:04 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/stream1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/stream1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 86, "payload_entropy": 4.937738377163204, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c70feef3acd3eef48b3e86c83e96243f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ada362ddce67ae574fe79e85e54d312f60228af", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:04 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1/main RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1/main RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 92, "payload_entropy": 5.053362162946347, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "319b2a3daf589cab18975b479da48606", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df956ff742173b52a62f3fe1940af97eb5012548", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:04 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 87, "payload_entropy": 4.979055605776413, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "15a7c41d381e2b82b7717741b6680751", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "def9bfbc7df17bf42239710eeb16b6eeee40d57a", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:03 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/mpeg4 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/mpeg4 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 84, "payload_entropy": 4.962091643166646, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3192bd83cf1bcda052e9aa023bb7fe6f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0eb9dfa620aecc01c2b2d6f9d0762d91852dc234", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/mpeg4 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:03 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 99, "payload_entropy": 5.05991966182411, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2b2b139cf820f4099397c5ab6755c82e", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "addd9632c9dc077d8a1d9bd5bb66832941a11cb9", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:02 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/ch00_0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/ch00_0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 90, "payload_entropy": 5.023642368691698, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9e83680164253a0d2f90560d4c0d7096", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c839dd8a3637a1cfd8a3720c41014ac2cefe39a3", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/ch00_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:02 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 82, "payload_entropy": 4.957625327551364, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a86847dc45cf5418811a12536a0fed17", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9fee4d2f4fe2ca1db9cc698363acc8aad85283ec", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:02 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 84, "payload_entropy": 4.963280517810811, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cce398c859cdf2f4a02f498a93e950b9", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66b97ca11f3ca6605c0d4c5750f89ffb757060e6", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:02 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/live/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/live/0 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 85, "payload_entropy": 4.954699871528942, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d993b37fa06054e08477985f1c0d131b", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a717780e5633439848bf3a3f6c39df38d7b231e", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/live\/0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:02 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch1 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 82, "payload_entropy": 4.961167937983721, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a3d2ec127fd1928e6c34e11f3325dc6c", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c57614ff14c706a22ca3ca395bd866fe9bf1803f", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:01 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 88, "payload_entropy": 4.97849390366616, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a65416c01bf5a161feca0bf098936c5f", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34432622514899f33516a77e698a70a2c77d7df8", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }
18/06/2026 17:14:01 UTC	TCP	554 · RTSP	rtsp	Sonde RTSP rtsp probe · via RTSP:554 · (sonde / probe)	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags net_rtsp_probe rtsp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload OPTIONS rtsp://62.3.50.33:554/h264/ch1/sub/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 47 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS rtsp://62.3.50.33:554/h264/ch1/sub/av_stream RTSP/1.0 CSeq: 1 User-Agent: Lavf60.16.100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 101, "payload_entropy": 5.104648458785605, "port_category": "well_known", "org": "Datacamp Limited", "service": "rtsp", "app_proto": "rtsp", "asn": 60068, "country": "IT", "dst_port": 554, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 47, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c612347518e049ce96c448df76dc171f725494ef", "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0382", "INT-upstream" ], "kb_rule_ids": [ "pat-0382", "INT-upstream" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0420" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IT", "asn": 60068, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e4c872925138177abfc7b2d3fd3da0c0", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 47 }, "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "evidence": { "request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100\r\n\r\n", "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf659918a9a505d417260f9a35ebce8a11cc7c71", "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 47 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": [ "pat-0382", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0382", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/h264\/ch1\/sub\/av_stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf60.16.100", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_rtsp_probe", "rtsp_probe" ] }

212.102.54.136

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence