|
|
TCP |
3002 · HTTP
|
http
|
probe config
probe config · via HTTP:3002 · (sonde / probe) · → /config
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_body_with_get
http_probe_config
Cible HTTP
GET
/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/config
Pourquoi cette classification : Type « probe_config » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — 2 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /config HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.
Requête brute (extrait)
GET /config HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */*
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": null,
"http_target_hash": "3383ee1869025a20c1a7d96b3e957f247716cc75",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 163,
"payload_entropy": 5.41270925382812,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 60,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "94e9be091d998d13328653bb51a6ba90e0fdaf0c",
"event_fingerprint": "2be81fe78fa91237bbbf918971996ca8d566dfb1",
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "e09f4743838ca1c7fa43cd16241a1ae6",
"path_pattern_hash": "01d0ea696869632ca69da251f24e240d"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.",
"method": "GET",
"path": "\/config",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config HTTP\/1.1",
"request_sample": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.",
"evidence": {
"method": "GET",
"path": "\/config",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config HTTP\/1.1",
"request_sample": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.",
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31bced2178b5e658723c0e0ed424042e28b457b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config",
"request_line": "GET \/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.",
"attack_vector": "probe config \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config",
"request_line": "GET \/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe config \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config",
"evidence_snippet": "GET \/config HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_body_with_get",
"http_probe_config"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /backend/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/backend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/
Requête brute (extrait)
GET /backend/.env HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */*
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": null,
"http_target_hash": "43427b722c17a9a0bc6fc425a8ca9501d2c985f0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 169,
"payload_entropy": 5.415515573423859,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "913c5fd49ddb05b612d2afb5d6a85cc0fd5dce1f",
"event_fingerprint": "cc54ddcb05a57290eede8ae49071a485320dcfbc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "09b6c669cf8f4c2c94bbbe3997c948ab",
"path_pattern_hash": "1ffd9afa4ff51d558fbb13c458726c9c"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
"method": "GET",
"path": "\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
"evidence": {
"method": "GET",
"path": "\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bf0f1d053f368e795a0f0cc766c827f11a4a55b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env",
"request_line": "GET \/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env",
"request_line": "GET \/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env",
"evidence_snippet": "GET \/backend\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_body_with_get",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /api/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/api/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
k8s-api
Payload (extrait)
GET /api/.env HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.
Requête brute (extrait)
GET /api/.env HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": null,
"http_target_hash": "f5b7d21cf92d5caca6cd906725e72730e31bc18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.398966345393449,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "3a7f8281fd36e90f8fb94f7e53e1a0da41a9f526",
"event_fingerprint": "423322bca97965f81f677f5a1f831a2a9f1170cf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "19749b22706b03f1796139502558e415",
"path_pattern_hash": "3c658e3b68f996f41891a76e1d05a9a5"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"evidence": {
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29959f28160e51482a14377ade183c3c588d7560",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"evidence_snippet": "GET \/api\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"http_backup_file_scan",
"http_body_with_get",
"http_probe_api",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4200 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:4200 · (tentative d'exploit) · → /app/.env
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4200
Chemin / cible
/app/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /app/.env HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.
Requête brute (extrait)
GET /app/.env HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */*
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": null,
"http_target_hash": "628b9cb47d9f8d6e8fddc1b7d3cebf1133d17f4f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.402191005851869,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 4200,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "424d77b019b70d01a994894fcaea4da3cf3ab267",
"event_fingerprint": "15a2c97ac94850cee8dace20e17323929213f31b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "782f18675d0ea07934ce8cb22a30ac02",
"path_pattern_hash": "6215588c522bb159cbcefac1cb9fb1de"
},
"target_context": {
"dst_port": 4200,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"method": "GET",
"path": "\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app\/.env HTTP\/1.1",
"request_sample": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"evidence": {
"method": "GET",
"path": "\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app\/.env HTTP\/1.1",
"request_sample": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\n\r\n\u0000",
"payload_snippet": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "206a3db7ff83e66da82569a6995c9f271b557a82",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.env",
"request_line": "GET \/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 4200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"attack_vector": "config file probe \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env",
"target_port_label": "4200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4200,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.env",
"request_line": "GET \/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 4200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env",
"evidence_snippet": "GET \/app\/.env HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.",
"target_port_label": "4200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_body_with_get",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{�OF�d�㗩�A3�,��[9IH� ��-> j��#F��B/�a\��p�g=J��?��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{�OF�d�㗩�A3�,��[9IH� ��-> j��#F��B/�a\��p�g=J��?��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{�OF�d�㗩�A3�,��[9IH� ��-> j��#F��B/�a\��p�g=J��?��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.56551875624575,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "378a5c2fe1e8315b0f69c1ba3bf164db",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\u0012\u0005OF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9\u0003IH\u0002\ufffd\u001f\ufffd\u0007\u0004\ufffd-> j\u0004\ufffd\ufffd#F\ufffd\ufffd\u0010B\/\ufffda\u0019\u0001\u0004\\\ufffd\ufffdp\ufffd\u0014g=J\ufffd\ufffd?\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\u0012\u0005OF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9\u0003IH\u0002\ufffd\u001f\ufffd\u0007\u0004\ufffd-> j\u0004\ufffd\ufffd#F\ufffd\ufffd\u0010B\/\ufffda\u0019\u0001\u0004\\\ufffd\ufffdp\ufffd\u0014g=J\ufffd\ufffd?\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\u0012\u0005OF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9\u0003IH\u0002\ufffd\u001f\ufffd\u0007\u0004\ufffd-> j\u0004\ufffd\ufffd#F\ufffd\ufffd\u0010B\/\ufffda\u0019\u0001\u0004\\\ufffd\ufffdp\ufffd\u0014g=J\ufffd\ufffd?\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44d43d78ac02c79b57a2d5799ea5f37d8cfcbfe3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\u0012\u0005OF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9\u0003IH\u0002\ufffd\u001f\ufffd\u0007\u0004\ufffd-> j\u0004\ufffd\ufffd#F\ufffd\ufffd\u0010B\/\ufffda\u0019\u0001\u0004\\\ufffd\ufffdp\ufffd\u0014g=J\ufffd\ufffd?\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffdOF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9IH\ufffd\ufffd\ufffd-> j\ufffd\ufffd#F\ufffd\ufffdB\/\ufffda\\\ufffd\ufffdp\ufffdg=J\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\u0012\u0005OF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9\u0003IH\u0002\ufffd\u001f\ufffd\u0007\u0004\ufffd-> j\u0004\ufffd\ufffd#F\ufffd\ufffd\u0010B\/\ufffda\u0019\u0001\u0004\\\ufffd\ufffdp\ufffd\u0014g=J\ufffd\ufffd?\u0004\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffdOF\ufffdd\ufffd\u35e9\ufffdA3\ufffd,\ufffd\ufffd[9IH\ufffd\ufffd\ufffd-> j\ufffd\ufffd#F\ufffd\ufffdB\/\ufffda\\\ufffd\ufffdp\ufffdg=J\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{M)d�́>�sT�pX�<�c�Q�Ѿ �W�8� r��%FS����kM\վS J��!�h*��A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{M)d�́>�sT�pX�<�c�Q�Ѿ �W�8� r��%FS����kM\վS J��!�h*��A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{M)d�́>�sT�pX�<�c�Q�Ѿ �W�8� r��%FS����kM\վS J��!�h*��A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.531577182670674,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88057ff09052fdd55e8147b4834c278e",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003M)d\ufffd\u0014\u0301>\ufffdsT\u001b\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\u001c\ufffd\u0018W\ufffd8\ufffd r\ufffd\ufffd\b%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057e\u0015S\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003M)d\ufffd\u0014\u0301>\ufffdsT\u001b\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\u001c\ufffd\u0018W\ufffd8\ufffd r\ufffd\ufffd\b%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057e\u0015S\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003M)d\ufffd\u0014\u0301>\ufffdsT\u001b\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\u001c\ufffd\u0018W\ufffd8\ufffd r\ufffd\ufffd\b%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057e\u0015S\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e572220c4a72a8b3db31f480cb01b76a7874f22d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003M)d\ufffd\u0014\u0301>\ufffdsT\u001b\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\u001c\ufffd\u0018W\ufffd8\ufffd r\ufffd\ufffd\b%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057e\u0015S\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{M)d\ufffd\u0301>\ufffdsT\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\ufffdW\ufffd8\ufffd r\ufffd\ufffd%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057eS\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003M)d\ufffd\u0014\u0301>\ufffdsT\u001b\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\u001c\ufffd\u0018W\ufffd8\ufffd r\ufffd\ufffd\b%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057e\u0015S\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{M)d\ufffd\u0301>\ufffdsT\ufffdpX\ufffd<\ufffdc\ufffdQ\ufffd\u047e\ufffdW\ufffd8\ufffd r\ufffd\ufffd%FS\ufffd\ufffd\ufffd\ufffdkM\\\u057eS\tJ\ufffd\ufffd!\ufffdh*\ufffd\ufffdA\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{��8z+;��f�]I�� B$ �,��[�a�� V��������)��b'�&_i�] ���*A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{��8z+;��f�]I��
B$ �,��[�a�� V��������)��b'�&_i�] ���*A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{��8z+;��f�]I�� B$ �,��[�a�� V��������)��b'�&_i�] ���*A� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.545468352782918,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58037f1eb7fd61a26a30d0da2d00a61c",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\u0010\ufffd\rB$\u001f\ufffd,\u0011\ufffd\ufffd\u0013[\u0006\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\u001a\u001e\ufffd\ufffd\ufffd*A\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\u0010\ufffd\rB$\u001f\ufffd,\u0011\ufffd\ufffd\u0013[\u0006\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\u001a\u001e\ufffd\ufffd\ufffd*A\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\u0010\ufffd\rB$\u001f\ufffd,\u0011\ufffd\ufffd\u0013[\u0006\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\u001a\u001e\ufffd\ufffd\ufffd*A\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6b7875be4d91ebf82c1059a406d723cde1ada66",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\u0010\ufffd\rB$\u001f\ufffd,\u0011\ufffd\ufffd\u0013[\u0006\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\u001a\u001e\ufffd\ufffd\ufffd*A\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\ufffd\rB$\ufffd,\ufffd\ufffd[\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\ufffd\ufffd\ufffd*A\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\u0010\ufffd\rB$\u001f\ufffd,\u0011\ufffd\ufffd\u0013[\u0006\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\u001a\u001e\ufffd\ufffd\ufffd*A\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffd\ufffd8z+;\ufffd\ufffdf\ufffd]I\ufffd\ufffd\rB$\ufffd,\ufffd\ufffd[\ufffda\ufffd\ufffd V\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffdb'\ufffd&_i\ufffd]\ufffd\ufffd\ufffd*A\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{dn� �=�=�dVBƹ� �d �Q#?^H��)� ���U2� �aLq洱�R<lR��[!����� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{dn� �=�=�dVBƹ� �d �Q#?^H��)� ���U2�
�aLq洱�R<lR��[!����� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{dn� �=�=�dVBƹ� �d �Q#?^H��)� ���U2� �aLq洱�R<lR��[!����� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.531902085122678,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "377832749ae53b958a69e2f0a6be7bec",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003dn\ufffd\u0000\ufffd=\ufffd=\ufffddVB\u0002\u001b\u01b9\ufffd\u001f\u0018\ufffdd\u000b\ufffdQ#?^H\ufffd\ufffd)\ufffd \u0004\ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffd\u0002R<lR\ufffd\ufffd[!\u0010\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003dn\ufffd\u0000\ufffd=\ufffd=\ufffddVB\u0002\u001b\u01b9\ufffd\u001f\u0018\ufffdd\u000b\ufffdQ#?^H\ufffd\ufffd)\ufffd \u0004\ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffd\u0002R<lR\ufffd\ufffd[!\u0010\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003dn\ufffd\u0000\ufffd=\ufffd=\ufffddVB\u0002\u001b\u01b9\ufffd\u001f\u0018\ufffdd\u000b\ufffdQ#?^H\ufffd\ufffd)\ufffd \u0004\ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffd\u0002R<lR\ufffd\ufffd[!\u0010\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47aa40122541f1418f0618c80d7cd1e133e23157",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003dn\ufffd\u0000\ufffd=\ufffd=\ufffddVB\u0002\u001b\u01b9\ufffd\u001f\u0018\ufffdd\u000b\ufffdQ#?^H\ufffd\ufffd)\ufffd \u0004\ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffd\u0002R<lR\ufffd\ufffd[!\u0010\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{dn\ufffd\ufffd=\ufffd=\ufffddVB\u01b9\ufffd\ufffdd\ufffdQ#?^H\ufffd\ufffd)\ufffd \ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffdR<lR\ufffd\ufffd[!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003dn\ufffd\u0000\ufffd=\ufffd=\ufffddVB\u0002\u001b\u01b9\ufffd\u001f\u0018\ufffdd\u000b\ufffdQ#?^H\ufffd\ufffd)\ufffd \u0004\ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffd\u0002R<lR\ufffd\ufffd[!\u0010\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{dn\ufffd\ufffd=\ufffd=\ufffddVB\u01b9\ufffd\ufffdd\ufffdQ#?^H\ufffd\ufffd)\ufffd \ufffd\ufffd\ufffdU2\ufffd\n\ufffdaLq\u6d31\ufffdR<lR\ufffd\ufffd[!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{����(���@\_�ذt��cG�9c��%d �DE� ��bj�� �c� �����g�O4} ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{����(���@\_�ذt��cG�9c��%d �DE� ��bj�� �c�
�����g�O4} ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{����(���@\_�ذt��cG�9c��%d �DE� ��bj�� �c� �����g�O4} ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.553719252044527,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "62323cd5042301cbed12f6e7b7efb596",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\u0011\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0015\u0006\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\u0001\ufffd\u0011%d \u0014\ufffd\u000eDE\ufffd\u001d\ufffd\ufffdb\u0005j\ufffd\ufffd \u0003\ufffdc\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u000fg\ufffdO4}\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\u0011\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0015\u0006\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\u0001\ufffd\u0011%d \u0014\ufffd\u000eDE\ufffd\u001d\ufffd\ufffdb\u0005j\ufffd\ufffd \u0003\ufffdc\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u000fg\ufffdO4}\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\u0011\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0015\u0006\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\u0001\ufffd\u0011%d \u0014\ufffd\u000eDE\ufffd\u001d\ufffd\ufffdb\u0005j\ufffd\ufffd \u0003\ufffdc\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u000fg\ufffdO4}\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cecb80766709cfb43041d331409c208313ced39",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\u0011\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0015\u0006\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\u0001\ufffd\u0011%d \u0014\ufffd\u000eDE\ufffd\u001d\ufffd\ufffdb\u0005j\ufffd\ufffd \u0003\ufffdc\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u000fg\ufffdO4}\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\ufffd%d \ufffdDE\ufffd\ufffd\ufffdbj\ufffd\ufffd \ufffdc\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdO4}\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\u0011\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0015\u0006\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\u0001\ufffd\u0011%d \u0014\ufffd\u000eDE\ufffd\u001d\ufffd\ufffdb\u0005j\ufffd\ufffd \u0003\ufffdc\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u000fg\ufffdO4}\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd@\\_\ufffd\u0630t\ufffd\ufffdcG\ufffd9c\ufffd\ufffd%d \ufffdDE\ufffd\ufffd\ufffdbj\ufffd\ufffd \ufffdc\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdO4}\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{]Q�cd ��&�Z3B� 2��m�u��5M�^$� 5|a:W���X�o�Wњ�OaT~�Q�{�!�Χ" ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{]Q�cd ��&�Z3B�
2��m�u��5M�^$� 5|a:W���X�o�Wњ�OaT~�Q�{�!�Χ" ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{]Q�cd ��&�Z3B� 2��m�u��5M�^$� 5|a:W���X�o�Wњ�OaT~�Q�{�!�Χ" ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.525971511377588,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0d49174ec52c66c017cd69a6c1fa9b17",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003]Q\ufffdcd\u001f\ufffd\ufffd&\u0003\ufffdZ3B\ufffd\u0002\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffd\u0017\u0011OaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003]Q\ufffdcd\u001f\ufffd\ufffd&\u0003\ufffdZ3B\ufffd\u0002\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffd\u0017\u0011OaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003]Q\ufffdcd\u001f\ufffd\ufffd&\u0003\ufffdZ3B\ufffd\u0002\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffd\u0017\u0011OaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6523871e9420d2ec2d260bc81544b7606c6e81e5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003]Q\ufffdcd\u001f\ufffd\ufffd&\u0003\ufffdZ3B\ufffd\u0002\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffd\u0017\u0011OaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{]Q\ufffdcd\ufffd\ufffd&\ufffdZ3B\ufffd\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffdOaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003]Q\ufffdcd\u001f\ufffd\ufffd&\u0003\ufffdZ3B\ufffd\u0002\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffd\u0017\u0011OaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{]Q\ufffdcd\ufffd\ufffd&\ufffdZ3B\ufffd\r2\ufffd\ufffdm\ufffdu\ufffd\ufffd5M\ufffd^$\ufffd 5|a:W\ufffd\ufffd\ufffdX\ufffdo\ufffdW\u045a\ufffdOaT~\ufffdQ\ufffd{\ufffd!\ufffd\u03a7\"\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{��� �VT�SU���sj ��8_�X�~*IXo)� ҷ���V((��RYko��D� o� ���)��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{���
�VT�SU���sj
��8_�X�~*IXo)� ҷ���V((��RYko��D� o� ���)��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{��� �VT�SU���sj ��8_�X�~*IXo)� ҷ���V((��RYko��D� o� ���)��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.523170894215026,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "26104fe76a2037d6c5b5d371fb2b2b10",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\u000b\ufffd\u0005\ufffd\ufffd)\u0013\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\u000b\ufffd\u0005\ufffd\ufffd)\u0013\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\u000b\ufffd\u0005\ufffd\ufffd)\u0013\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5cc46caebb4f1923dc9dc72042d1d1c2a5fbf6cb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\u000b\ufffd\u0005\ufffd\ufffd)\u0013\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\u000b\ufffd\u0005\ufffd\ufffd)\u0013\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffd\ufffd\ufffd\r\ufffdVT\ufffdSU\ufffd\ufffd\ufffdsj\r\ufffd\ufffd8_\ufffdX\ufffd~*IXo)\ufffd \u04b7\ufffd\ufffd\ufffdV((\ufffd\ufffdRYko\ufffd\ufffdD\ufffd o\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{3�=����Ȅ/>4K A�E��|�<����{�p �ƒU�� �R'è.%�����r<g� ��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{3�=����Ȅ/>4K A�E��|�<����{�p �ƒU�� �R'è.%�����r<g� ��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{3�=����Ȅ/>4K A�E��|�<����{�p �ƒU�� �R'è.%�����r<g� ��� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.540148742608794,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "61aabd7143ffc05429645cf192fbb84d",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00033\ufffd=\ufffd\ufffd\u0003\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp\u0016 \ufffd\u0192U\ufffd\ufffd\u001c\ufffdR'\u0015\u0007\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\u0012\f\u0002\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00033\ufffd=\ufffd\ufffd\u0003\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp\u0016 \ufffd\u0192U\ufffd\ufffd\u001c\ufffdR'\u0015\u0007\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\u0012\f\u0002\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00033\ufffd=\ufffd\ufffd\u0003\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp\u0016 \ufffd\u0192U\ufffd\ufffd\u001c\ufffdR'\u0015\u0007\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\u0012\f\u0002\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2eeedaf4a9d04e41270a9347f1c849054b19fa8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00033\ufffd=\ufffd\ufffd\u0003\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp\u0016 \ufffd\u0192U\ufffd\ufffd\u001c\ufffdR'\u0015\u0007\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\u0012\f\u0002\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{3\ufffd=\ufffd\ufffd\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp \ufffd\u0192U\ufffd\ufffd\ufffdR'\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00033\ufffd=\ufffd\ufffd\u0003\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp\u0016 \ufffd\u0192U\ufffd\ufffd\u001c\ufffdR'\u0015\u0007\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\u0012\f\u0002\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{3\ufffd=\ufffd\ufffd\ufffd\ufffd\u0204\/>4K\tA\ufffdE\ufffd\ufffd|\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffdp \ufffd\u0192U\ufffd\ufffd\ufffdR'\u00e8.%\ufffd\ufffd\ufffd\ufffd\ufffdr<g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{�0�))�"�R3��5끒܈/�� ��6��Y��� ��d�S���pK�����jX gD��1:��H�LE ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{�0�))�"�R3��5끒܈/�� ��6��Y��� ��d�S���pK�����jX gD��1:��H�LE ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{�0�))�"�R3��5끒܈/�� ��6��Y��� ��d�S���pK�����jX gD��1:��H�LE ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.571380624553812,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "935d77d29d6a7aca2d16b7eedf1ddc62",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\u0011\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdp\u0007K\u0019\ufffd\ufffd\ufffd\ufffd\ufffdjX\u001egD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\u0011\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdp\u0007K\u0019\ufffd\ufffd\ufffd\ufffd\ufffdjX\u001egD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\u0011\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdp\u0007K\u0019\ufffd\ufffd\ufffd\ufffd\ufffdjX\u001egD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f8d9b451859e6d22bb6195cd0316f37def30fcf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\u0011\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdp\u0007K\u0019\ufffd\ufffd\ufffd\ufffd\ufffdjX\u001egD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdpK\ufffd\ufffd\ufffd\ufffd\ufffdjXgD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\u0011\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdp\u0007K\u0019\ufffd\ufffd\ufffd\ufffd\ufffdjX\u001egD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffd0\ufffd))\ufffd\"\ufffdR3\ufffd\ufffd5\ub052\u0708\/\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffdY\ufffd\ufffd\ufffd \ufffd\ufffdd\ufffdS\ufffd\ufffd\ufffdpK\ufffd\ufffd\ufffd\ufffd\ufffdjXgD\ufffd\ufffd1:\ufffd\ufffdH\ufffdLE\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{�R��� 2[ia�������� UwKt�ۭYٵ �m�m��^D�&����(����6�M�j�L� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{�R��� 2[ia�������� UwKt�ۭYٵ �m�m��^D�&����(����6�M�j�L� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{�R��� 2[ia�������� UwKt�ۭYٵ �m�m��^D�&����(����6�M�j�L� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.554012505398152,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c443e22fa0be9647cc4927d99dc29d2d",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u001d2[ia\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\fUwKt\ufffd\u06edY\b\u0675 \ufffd\u0012m\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd\u0004(\ufffd\u0001\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u001d2[ia\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\fUwKt\ufffd\u06edY\b\u0675 \ufffd\u0012m\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd\u0004(\ufffd\u0001\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u001d2[ia\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\fUwKt\ufffd\u06edY\b\u0675 \ufffd\u0012m\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd\u0004(\ufffd\u0001\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba7124586d0bed6eb87b764f87cb8e98f0fc70b3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u001d2[ia\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\fUwKt\ufffd\u06edY\b\u0675 \ufffd\u0012m\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd\u0004(\ufffd\u0001\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffdR\ufffd\ufffd\ufffd2[ia\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdUwKt\ufffd\u06edY\u0675 \ufffdm\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u001d2[ia\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\fUwKt\ufffd\u06edY\b\u0675 \ufffd\u0012m\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd\u0004(\ufffd\u0001\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffdR\ufffd\ufffd\ufffd2[ia\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdUwKt\ufffd\u06edY\u0675 \ufffdm\ufffdm\ufffd\ufffd^D\ufffd&\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd6\ufffdM\ufffdj\ufffdL\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{0^��E�~oSyS{�&=�q���8Ct|sp��� |�#�2 ��;F�� NyaT'�$��}��� )�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{0^��E�~oSyS{�&=�q���8Ct|sp��� |�#�2 ��;F��
NyaT'�$��}��� )�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{0^��E�~oSyS{�&=�q���8Ct|sp��� |�#�2 ��;F�� NyaT'�$��}��� )�� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.56228949964032,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fb163db1d0beaf1cbcbcfb63d780d172",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00030^\u0007\ufffd\ufffdE\ufffd~oSyS{\ufffd\b&=\ufffdq\ufffd\ufffd\ufffd8Ct\u0002|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd\u000e2\u001f\ufffd\ufffd;F\ufffd\ufffd\nNya\u0014T'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd\u001d)\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00030^\u0007\ufffd\ufffdE\ufffd~oSyS{\ufffd\b&=\ufffdq\ufffd\ufffd\ufffd8Ct\u0002|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd\u000e2\u001f\ufffd\ufffd;F\ufffd\ufffd\nNya\u0014T'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd\u001d)\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00030^\u0007\ufffd\ufffdE\ufffd~oSyS{\ufffd\b&=\ufffdq\ufffd\ufffd\ufffd8Ct\u0002|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd\u000e2\u001f\ufffd\ufffd;F\ufffd\ufffd\nNya\u0014T'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd\u001d)\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1446ec8467269681eda28fd5070d621d40ecdfb0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00030^\u0007\ufffd\ufffdE\ufffd~oSyS{\ufffd\b&=\ufffdq\ufffd\ufffd\ufffd8Ct\u0002|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd\u000e2\u001f\ufffd\ufffd;F\ufffd\ufffd\nNya\u0014T'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd\u001d)\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{0^\ufffd\ufffdE\ufffd~oSyS{\ufffd&=\ufffdq\ufffd\ufffd\ufffd8Ct|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd2\ufffd\ufffd;F\ufffd\ufffd\nNyaT'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u00030^\u0007\ufffd\ufffdE\ufffd~oSyS{\ufffd\b&=\ufffdq\ufffd\ufffd\ufffd8Ct\u0002|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd\u000e2\u001f\ufffd\ufffd;F\ufffd\ufffd\nNya\u0014T'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd\u001d)\ufffd\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{0^\ufffd\ufffdE\ufffd~oSyS{\ufffd&=\ufffdq\ufffd\ufffd\ufffd8Ct|sp\ufffd\ufffd\ufffd |\ufffd#\ufffd2\ufffd\ufffd;F\ufffd\ufffd\nNyaT'\ufffd$\ufffd\ufffd}\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{}�;�R�N} #|)B�G8&%� L�*� k��7 �P�������L_CO��{� 6�]� .<.� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{}�;�R�N} #|)B�G8&%� L�*� k��7 �P�������L_CO��{�
6�]� .<.� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{}�;�R�N} #|)B�G8&%� L�*� k��7 �P�������L_CO��{� 6�]� .<.� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.525082588554094,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7cea19fb84ee0727ee63e4fee4779f49",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd;\ufffdR\ufffdN\u001b}\u001d#|)B\ufffdG8&%\ufffd L\u0006\ufffd*\ufffd\u000bk\ufffd\ufffd7\b \ufffd\u0001P\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_\u0019CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd\u001d.<.\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd;\ufffdR\ufffdN\u001b}\u001d#|)B\ufffdG8&%\ufffd L\u0006\ufffd*\ufffd\u000bk\ufffd\ufffd7\b \ufffd\u0001P\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_\u0019CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd\u001d.<.\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd;\ufffdR\ufffdN\u001b}\u001d#|)B\ufffdG8&%\ufffd L\u0006\ufffd*\ufffd\u000bk\ufffd\ufffd7\b \ufffd\u0001P\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_\u0019CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd\u001d.<.\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19f0073f78f63ef757876f17055c60ce0ad638e9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd;\ufffdR\ufffdN\u001b}\u001d#|)B\ufffdG8&%\ufffd L\u0006\ufffd*\ufffd\u000bk\ufffd\ufffd7\b \ufffd\u0001P\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_\u0019CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd\u001d.<.\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{}\ufffd;\ufffdR\ufffdN}#|)B\ufffdG8&%\ufffd L\ufffd*\ufffdk\ufffd\ufffd7 \ufffdP\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd.<.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd;\ufffdR\ufffdN\u001b}\u001d#|)B\ufffdG8&%\ufffd L\u0006\ufffd*\ufffd\u000bk\ufffd\ufffd7\b \ufffd\u0001P\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_\u0019CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd\u001d.<.\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{}\ufffd;\ufffdR\ufffdN}#|)B\ufffdG8&%\ufffd L\ufffd*\ufffdk\ufffd\ufffd7 \ufffdP\ufffd\u03a2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL_CO\ufffd\ufffd{\ufffd\r6\ufffd]\ufffd.<.\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{��Q�R�q{��۵ \_>���O �s�*� Q��L��T��4� �ѣК�Y/MRk 9 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{��Q�R�q{��۵ \_>���O �s�*� Q��L��T��4� �ѣК�Y/MRk
9 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{��Q�R�q{��۵ \_>���O �s�*� Q��L��T��4� �ѣК�Y/MRk 9 ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.553064996058635,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "debc592469378935f8e6a850a27b72d4",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\u001f\\_\u0003\u0007>\ufffd\ufffd\u0018\ufffdO\f\ufffds\ufffd*\u0016\ufffd \u0006Q\ufffd\ufffdL\ufffd\ufffdT\u001a\u000f\ufffd\u0001\ufffd4\u0007\ufffd\u001c\ufffd\u0463\u041a\ufffd\u0001Y\/MRk\n9\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\u001f\\_\u0003\u0007>\ufffd\ufffd\u0018\ufffdO\f\ufffds\ufffd*\u0016\ufffd \u0006Q\ufffd\ufffdL\ufffd\ufffdT\u001a\u000f\ufffd\u0001\ufffd4\u0007\ufffd\u001c\ufffd\u0463\u041a\ufffd\u0001Y\/MRk\n9\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\u001f\\_\u0003\u0007>\ufffd\ufffd\u0018\ufffdO\f\ufffds\ufffd*\u0016\ufffd \u0006Q\ufffd\ufffdL\ufffd\ufffdT\u001a\u000f\ufffd\u0001\ufffd4\u0007\ufffd\u001c\ufffd\u0463\u041a\ufffd\u0001Y\/MRk\n9\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85c141d7b5dff7843e7021c7becb3570028bff64",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\u001f\\_\u0003\u0007>\ufffd\ufffd\u0018\ufffdO\f\ufffds\ufffd*\u0016\ufffd \u0006Q\ufffd\ufffdL\ufffd\ufffdT\u001a\u000f\ufffd\u0001\ufffd4\u0007\ufffd\u001c\ufffd\u0463\u041a\ufffd\u0001Y\/MRk\n9\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\\_>\ufffd\ufffd\ufffdO\ufffds\ufffd*\ufffd Q\ufffd\ufffdL\ufffd\ufffdT\ufffd\ufffd4\ufffd\ufffd\u0463\u041a\ufffdY\/MRk\n9\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\u001f\\_\u0003\u0007>\ufffd\ufffd\u0018\ufffdO\f\ufffds\ufffd*\u0016\ufffd \u0006Q\ufffd\ufffdL\ufffd\ufffdT\u001a\u000f\ufffd\u0001\ufffd4\u0007\ufffd\u001c\ufffd\u0463\u041a\ufffd\u0001Y\/MRk\n9\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{\ufffd\ufffdQ\ufffdR\ufffdq{\ufffd\ufffd\u06f5\\_>\ufffd\ufffd\ufffdO\ufffds\ufffd*\ufffd Q\ufffd\ufffdL\ufffd\ufffdT\ufffd\ufffd4\ufffd\ufffd\u0463\u041a\ufffdY\/MRk\n9\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{ Bsڕ98L6� efb�5��>�"f�:WM���� IZ�Qz?�A�ᡯYd{CM�,�?V{?�#�^R ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{ Bsڕ98L6� efb�5��>�"f�:WM���� IZ�Qz?�A�ᡯYd{CM�,�?V{?�#�^R ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{ Bsڕ98L6� efb�5��>�"f�:WM���� IZ�Qz?�A�ᡯYd{CM�,�?V{?�#�^R ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.525644508507491,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dde763d47c58f7736b2bfdbbab2efd5b",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\u0000Bs\u069598L6\ufffd\u0005\fefb\ufffd5\ufffd\ufffd>\ufffd\u0014\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{\u000f?\ufffd\b#\ufffd^R\u0003\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\u0000Bs\u069598L6\ufffd\u0005\fefb\ufffd5\ufffd\ufffd>\ufffd\u0014\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{\u000f?\ufffd\b#\ufffd^R\u0003\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\u0000Bs\u069598L6\ufffd\u0005\fefb\ufffd5\ufffd\ufffd>\ufffd\u0014\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{\u000f?\ufffd\b#\ufffd^R\u0003\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd947b1acfbf61e0a8576278a7955d580e71e18f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\u0000Bs\u069598L6\ufffd\u0005\fefb\ufffd5\ufffd\ufffd>\ufffd\u0014\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{\u000f?\ufffd\b#\ufffd^R\u0003\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{Bs\u069598L6\ufffdefb\ufffd5\ufffd\ufffd>\ufffd\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{?\ufffd#\ufffd^R\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003\u0000Bs\u069598L6\ufffd\u0005\fefb\ufffd5\ufffd\ufffd>\ufffd\u0014\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{\u000f?\ufffd\b#\ufffd^R\u0003\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{Bs\u069598L6\ufffdefb\ufffd5\ufffd\ufffd>\ufffd\"f\ufffd:WM\ufffd\ufffd\ufffd\ufffd IZ\ufffdQz?\ufffdA\ufffd\u186fYd{CM\ufffd,\ufffd?V{?\ufffd#\ufffd^R\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{12��ZI� �[�l��;��˳9�ZX�ܭQ�i1[ >Y�*iS�ls�AG|��"}(䲋��]�៌ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{12��ZI� �[�l��;��˳9�ZX�ܭQ�i1[ >Y�*iS�ls�AG|��"}(䲋��]�៌ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{12��ZI� �[�l��;��˳9�ZX�ܭQ�i1[ >Y�*iS�ls�AG|��"}(䲋��]�៌ ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.5154178483336,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b9d6f24f0d00c94090a7a994528d8030",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u000312\ufffd\ufffdZI\ufffd\u001c\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u0015\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >\u0005Y\ufffd*iS\ufffdls\ufffdA\u0004G|\ufffd\ufffd\u0011\"}\u0010(\u4c8b\ufffd\ufffd]\ufffd\u17cc\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u000312\ufffd\ufffdZI\ufffd\u001c\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u0015\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >\u0005Y\ufffd*iS\ufffdls\ufffdA\u0004G|\ufffd\ufffd\u0011\"}\u0010(\u4c8b\ufffd\ufffd]\ufffd\u17cc\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u000312\ufffd\ufffdZI\ufffd\u001c\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u0015\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >\u0005Y\ufffd*iS\ufffdls\ufffdA\u0004G|\ufffd\ufffd\u0011\"}\u0010(\u4c8b\ufffd\ufffd]\ufffd\u17cc\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab582a236f4d2a98a61abf1f69bb36a4f86cde43",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u000312\ufffd\ufffdZI\ufffd\u001c\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u0015\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >\u0005Y\ufffd*iS\ufffdls\ufffdA\u0004G|\ufffd\ufffd\u0011\"}\u0010(\u4c8b\ufffd\ufffd]\ufffd\u17cc\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{12\ufffd\ufffdZI\ufffd\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >Y\ufffd*iS\ufffdls\ufffdAG|\ufffd\ufffd\"}(\u4c8b\ufffd\ufffd]\ufffd\u17cc\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u000312\ufffd\ufffdZI\ufffd\u001c\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u0015\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >\u0005Y\ufffd*iS\ufffdls\ufffdA\u0004G|\ufffd\ufffd\u0011\"}\u0010(\u4c8b\ufffd\ufffd]\ufffd\u17cc\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{12\ufffd\ufffdZI\ufffd\ufffd[\ufffdl\ufffd\ufffd;\ufffd\ufffd\u02f39\ufffdZX\ufffd\u072dQ\ufffdi1[ >Y\ufffd*iS\ufffdls\ufffdAG|\ufffd\ufffd\"}(\u4c8b\ufffd\ufffd]\ufffd\u17cc\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{f���Hl��f�� h_��?t}FK;��(6]p ˟����<�t�`r~2x e� F�q$bw� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{f���Hl��f�� h_��?t}FK;��(6]p ˟����<�t�`r~2x e� F�q$bw� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{f���Hl��f�� h_��?t}FK;��(6]p ˟����<�t�`r~2x e� F�q$bw� ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.5034040383067016,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1b215662e1b1af20270e47dddb11f1e3",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffd\u000bh_\ufffd\ufffd?t}FK\u0001;\ufffd\ufffd(6]p \u001d\u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~\u00102x\te\ufffd\u001d\u001dF\ufffdq$bw\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffd\u000bh_\ufffd\ufffd?t}FK\u0001;\ufffd\ufffd(6]p \u001d\u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~\u00102x\te\ufffd\u001d\u001dF\ufffdq$bw\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffd\u000bh_\ufffd\ufffd?t}FK\u0001;\ufffd\ufffd(6]p \u001d\u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~\u00102x\te\ufffd\u001d\u001dF\ufffdq$bw\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bab59f3398b93493ba22bf3f99d9a0b50c90cbbb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffd\u000bh_\ufffd\ufffd?t}FK\u0001;\ufffd\ufffd(6]p \u001d\u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~\u00102x\te\ufffd\u001d\u001dF\ufffdq$bw\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffdh_\ufffd\ufffd?t}FK;\ufffd\ufffd(6]p \u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~2x\te\ufffdF\ufffdq$bw\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffd\u000bh_\ufffd\ufffd?t}FK\u0001;\ufffd\ufffd(6]p \u001d\u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~\u00102x\te\ufffd\u001d\u001dF\ufffdq$bw\ufffd\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{f\ufffd\ufffd\ufffdHl\ufffd\ufffdf\ufffd\ufffdh_\ufffd\ufffd?t}FK;\ufffd\ufffd(6]p \u02df\ufffd\ufffd\ufffd\ufffd<\ufffdt\ufffd`r~2x\te\ufffdF\ufffdq$bw\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
minecraft probe
minecraft probe · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
{}�j�s?r�� �}����]P �=!ȁ@a��k �T �B^�� ����w�Z I?� ����i ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
{}�j�s?r��
�}����]P
�=!ȁ@a��k �T
�B^�� ����w�Z I?� ����i ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � �����
Requête brute (extrait)
{}�j�s?r�� �}����]P �=!ȁ@a��k �T �B^�� ����w�Z I?� ����i ��,�0 � �̨̩̪�����]�a�W�S ��+�/ � ������\�`�V�R ����������$�( k j�s�w � � m ��#�' g @�r�v � � l �� � 9 8 � �� : �� � 3 2 E D� 4 F ����Q ����P���� = � < � 5 � / A�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1410,
"payload_entropy": 7.5539209664977145,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "https",
"app_proto": "https",
"asn": 14618,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"confidence": 0.42,
"classification_confidence": 0.42,
"precision_score": 50,
"precision_signals": [
"pat-0554"
],
"kb_rule_ids": [
"pat-0554"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 42,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b932d19de888496b819f2fde65632a2c",
"path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd\u000fj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]\u0003P\n\ufffd\u000f=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\u001c\ufffd\u0014\ufffd\ufffd\u0004\ufffdw\ufffdZ\tI?\u0378\ufffd\u0019\u001f\ufffd\ufffd\ufffd\ufffdi\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd\u000fj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]\u0003P\n\ufffd\u000f=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\u001c\ufffd\u0014\ufffd\ufffd\u0004\ufffdw\ufffdZ\tI?\u0378\ufffd\u0019\u001f\ufffd\ufffd\ufffd\ufffdi\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\ufffd\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd\u000fj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]\u0003P\n\ufffd\u000f=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\u001c\ufffd\u0014\ufffd\ufffd\u0004\ufffdw\ufffdZ\tI?\u0378\ufffd\u0019\u001f\ufffd\ufffd\ufffd\ufffdi\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"game_server_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53fd561cdb26b849597cf952d3231c873f26ebe5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd\u000fj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]\u0003P\n\ufffd\u000f=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\u001c\ufffd\u0014\ufffd\ufffd\u0004\ufffdw\ufffdZ\tI?\u0378\ufffd\u0019\u001f\ufffd\ufffd\ufffd\ufffdi\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "{}\ufffdj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]P\n\ufffd=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdZ\tI?\u0378\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 42,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\u0001\u0000\u0006{\u0003\u0003}\ufffd\u000fj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]\u0003P\n\ufffd\u000f=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\u001c\ufffd\u0014\ufffd\ufffd\u0004\ufffdw\ufffdZ\tI?\u0378\ufffd\u0019\u001f\ufffd\ufffd\ufffd\ufffdi\u0000\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "{}\ufffdj\ufffds?r\ufffd\ufffd\n\ufffd}\ufffd\ufffd\ufffd\ufffd]P\n\ufffd=!\u0201@a\ufffd\ufffdk \ufffdT\r\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdZ\tI?\u0378\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|