|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.295953359083483,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "41f572c723c165299c0b090377ae9b46",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c8274f70dfceab1224665bed500e6b8f4b360c8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YmFja3VwOjEyMzQ1Njc4",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.269595887775745,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "17f445845bbbcff096d7eb18d0e8422e",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39adffa111772c19994c73294561aed1d793c74a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YW5zaWJsZToxMjM0NTY3OA==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 59,
"payload_entropy": 4.428567626619114,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "070f2652b9e6ab9c9e629dd7efe972b8",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "acfc4064dec418036bac3f470e8e8fbcc6bbd26a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.147555526926021,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c8b335645cf61033151ea40c2a857bc7",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "822f343d8979ab1845240eb2a1bc868feed89022",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic MTox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 92,
"payload_entropy": 5.037202517098275,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d0eb8bd962bb33cc6942b9071cd246c",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9eeacd2cdd031a69ccfb3057bc07450c8d50403f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic MTox",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.27289572023466,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "454bd95ad37135c9838705b2d4919ba5",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "861a448576871bd93ec5d771da8c3064028dd205",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic bGlhbmc6bGlhbmcyMDI1",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.25614228121006,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b87446348ad897f904bf03edf1a0856a",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19eead63fcd974ee0e3edf87f84521dcb742cd2d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic Y2xpZW50OnBhc3N3b3Jk",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.383082151066973,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cb9ccd109992d188cff2a0ec9d7acfe8",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94320965627674bf724a638d66a44769583adfb0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46U3VwZXIxMjM=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.338430762280625,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5da9a86cdb812a678479c0ff8466db1",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f2a1c35932043c39a7824131bb910780ea4e13b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dGVzdDoxMjM0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.216405505932689,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2daed672b46efb0a0471a19f12060732",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "235ab7e4d351252784f449f7a9ae1d6b80c7b8df",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic cm9vdDphc2QxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.340823464138616,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "100bb0554ba411f8f1f269675e1401fc",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d847f885e9776b9028683758ee1137211436723a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDphc2QxMjM=",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.278351811711311,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "62e09274cb0ea57b6254d58de18c5fe7",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e6710fb74539e1183767809c73e014b2a5fde24",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.349659554081448,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a69124180a1dc82e862a289ec9c1371a",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8346d74198aadd6e43a507ebf9a2159eccc963e1",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjpqZW5uaWZlcg==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.308083396714105,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d121a389463e5cdd07766964bd774ce",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37385d5233685e442cca2b75c67d7435a7e32a8d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic YWRtaW46UXdlcnR5MTIz",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.303544276383799,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2bd56b3d6a94306537b1156c5929d8da",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd6f01b70143434a5d243a3d152691e219ca3547",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.411040947443398,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ceae0b32831637e98d2bf3af55494c2b",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e935ce419905af9686abbdd5d52875e867c53d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic cm9vdDpUZXN0MTIzIQ==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dXNlcjp6YWcxMndzeA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.364563632548456,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9a527371a885f3f7476d71c3d60fb22",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ee974a5e1f6361fee8811e712c4ea6494637168",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 31.57.216.45:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 31.57.216.45:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
31.57.216.45:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8501
Chemin / cible
31.57.216.45:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 31.57.216.45:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 31.57.216.45:80 HTTP/1.0
Host: 31.57.216.45:80
Proxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "45:80",
"http_ua_hash": null,
"http_host_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_target_hash": "4a84cbed4b39c27888f9278eb9926cfcd0ccfc36",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.408590368679598,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217",
"event_fingerprint": "e0269a1e646b906938c87470dd2b63ac7090bf94",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2d965777635dca39ce3185a69e299c3",
"path_pattern_hash": "e20d6dc2d32110a066519a3a78acbb75"
},
"service_name": "http",
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==\r\n\r\n",
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==",
"evidence": {
"method": "CONNECT",
"path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"request_sample": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==\r\n\r\n",
"payload_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c621214f91ada8ed06ad7b71202e3245990b877",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "31.57.216.45:80",
"request_line": "CONNECT 31.57.216.45:80 HTTP\/1.1",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 31.57.216.45:80",
"evidence_snippet": "CONNECT 31.57.216.45:80 HTTP\/1.0\r\nHost: 31.57.216.45:80\r\nProxy-Authorization: Basic dXNlcjppbG92ZXlvdQ==",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-wan",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8501 · CONSUL WAN
|
consul-wan
|
consul probe
consul probe · via CONSUL WAN:8501 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL-WAN
WAF
—
Recommandation
Surveiller
Tags
consul_wan_emulated
net_consul_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8501
Chemin / cible
—
Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "consul-wan",
"app_proto": "consul-wan",
"asn": 197769,
"country": "AE",
"dst_port": 8501,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1",
"event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0",
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "consul-wan",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "AE",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2"
},
"target_context": {
"dst_port": 8501,
"service": "consul-wan",
"service_name": "consul-wan",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5",
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "consul-wan",
"service_label_fr": "CONSUL WAN",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul-wan",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8501,
"service": "consul-wan",
"service_label_fr": "CONSUL WAN"
},
"attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8501 \u00b7 CONSUL WAN",
"emulator_service": "consul-wan",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul_wan",
"service_banner": "honeypot-consul-wan",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_wan_emulated",
"net_consul_probe"
],
"asn_dc_heuristic": true
}
|