|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b5a49662fb8673b2
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ��Y�Q��:$!�(�9�<z� j5�L7_��ȁ� ы8h�W Ckf6��� � �2D�d��mV��C �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Y�Q��:$!�(�9�<z� j5�L7_��ȁ� ы8h�W
Ckf6��� � �2D�d��mV��C �,�+̩�0�/̨ � �
#
Requête brute (extrait)
� ��Y�Q��:$!�(�9�<z� j5�L7_��ȁ� ы8h�W Ckf6��� � �2D�d��mV��C �,�+̩�0�/̨ � � # http/1.1 + 3 & $ aAz5O�O:v�O�Mq� ��+] D>�6o�, -
Meta JSON brut
{
"tls_ja3_hash": "b5a49662fb8673b23569cdd26bcaf0ac",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.851922764064249,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "492e7ccf66c8b6815b6129764f16bb8cefb29c6b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b5a49662fb8673b23569cdd26bcaf0ac",
"payload_hash": "6ec1ca8fdedf2409d5dfee0eb4f083d2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "3eb2ee6582466ae36a611229a393d7aa",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-35-11-16-13-43-51-5-45-23,29-23-24,0",
"tls_ja4_hash": "3eb2ee6582466ae36a611229a393d7aa",
"tls_ja4": "t13d0110_fcc08b2f1439_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd\u00069\ufffd<z\ufffd\u0000j5\ufffdL7_\u0001\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\u000f\nCkf6\ufffd\ufffd\ufffd\u000b\ufffd\u0000\u000e\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\u001a\ufffdC\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd\u00069\ufffd<z\ufffd\u0000j5\ufffdL7_\u0001\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\u000f\nCkf6\ufffd\ufffd\ufffd\u000b\ufffd\u0000\u000e\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\u001a\ufffdC\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 aAz\u00045O\ufffdO:v\ufffd\u0018O\u0004\ufffdMq\ufffd\r\ufffd\ufffd+]\u001fD>\ufffd6o\ufffd\u001b,\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd\u00069\ufffd<z\ufffd\u0000j5\ufffdL7_\u0001\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\u000f\nCkf6\ufffd\ufffd\ufffd\u000b\ufffd\u0000\u000e\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\u001a\ufffdC\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a1c5dfdb91b80d37842ce655ec36ad8fd0d35ff",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd\u00069\ufffd<z\ufffd\u0000j5\ufffdL7_\u0001\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\u000f\nCkf6\ufffd\ufffd\ufffd\u000b\ufffd\u0000\u000e\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\u001a\ufffdC\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"tls_ja3": "b5a49662fb8673b23569cdd26bcaf0ac",
"tls_ja4": "3eb2ee6582466ae36a611229a393d7aa",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd9\ufffd<z\ufffdj5\ufffdL7_\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\nCkf6\ufffd\ufffd\ufffd\ufffd\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\ufffdC\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd\u00069\ufffd<z\ufffd\u0000j5\ufffdL7_\u0001\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\u000f\nCkf6\ufffd\ufffd\ufffd\u000b\ufffd\u0000\u000e\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\u001a\ufffdC\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"tls_ja3": "b5a49662fb8673b23569cdd26bcaf0ac",
"tls_ja4": "3eb2ee6582466ae36a611229a393d7aa",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdY\ufffdQ\ufffd\ufffd:$!\ufffd(\ufffd9\ufffd<z\ufffdj5\ufffdL7_\ufffd\ufffd\u0201\ufffd \u044b8h\ufffdW\nCkf6\ufffd\ufffd\ufffd\ufffd\ufffd2D\ufffdd\ufffd\ufffdmV\ufffd\ufffdC\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1c8b872dd96fb096
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �~LR��ꎘK� � �w:)�h�>�ʄU�K��9 ������ C�n���t���f�\k��~��c �,�+̩�0�/̨ � � +
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �~LR��ꎘK� � �w:)�h�>�ʄU�K��9 ������ C�n���t���f�\k��~��c �,�+̩�0�/̨ � � +
Requête brute (extrait)
� �~LR��ꎘK� � �w:)�h�>�ʄU�K��9 ������ C�n���t���f�\k��~��c �,�+̩�0�/̨ � � + # http/1.1 - 3 & $ �0��@�MD/��m%%�L��3�H���qԠ�!=
Meta JSON brut
{
"tls_ja3_hash": "1c8b872dd96fb0962aacb1d5a8d8a1ea",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.912240745050203,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "f286586a794411e74515f07b4361c8e068e40504",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1c8b872dd96fb0962aacb1d5a8d8a1ea",
"payload_hash": "32bc0ac62c703379711ec99611a8c2e9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "fd218dafca5cd8533706903f26ed700f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-10-35-16-5-13-11-45-51,29-23-24,0",
"tls_ja4_hash": "fd218dafca5cd8533706903f26ed700f",
"tls_ja4": "t13d0110_fdbb74c80f15_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~LR\ufffd\ufffd\ua398K\ufffd\u0000\u0006\ufffd\u0014 \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\u001a\ufffdt\ufffd\u0015\ufffd\u0019\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\u001d\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~LR\ufffd\ufffd\ua398K\ufffd\u0000\u0006\ufffd\u0014 \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\u001a\ufffdt\ufffd\u0015\ufffd\u0019\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\u001d\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd0\ufffd\ufffd@\ufffd\u0016MD\/\ufffd\ufffdm%%\ufffdL\ufffd\ufffd3\ufffdH\ufffd\ufffd\ufffdq\u0520\ufffd!=",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~LR\ufffd\ufffd\ua398K\ufffd\u0000\u0006\ufffd\u0014 \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\u001a\ufffdt\ufffd\u0015\ufffd\u0019\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\u001d\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9be791774c9453a3140b233d271290d978324860",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~LR\ufffd\ufffd\ua398K\ufffd\u0000\u0006\ufffd\u0014 \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\u001a\ufffdt\ufffd\u0015\ufffd\u0019\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\u001d\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "1c8b872dd96fb0962aacb1d5a8d8a1ea",
"tls_ja4": "fd218dafca5cd8533706903f26ed700f",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd~LR\ufffd\ufffd\ua398K\ufffd\ufffd \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~LR\ufffd\ufffd\ua398K\ufffd\u0000\u0006\ufffd\u0014 \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\u001a\ufffdt\ufffd\u0015\ufffd\u0019\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\u001d\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "1c8b872dd96fb0962aacb1d5a8d8a1ea",
"tls_ja4": "fd218dafca5cd8533706903f26ed700f",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd~LR\ufffd\ufffd\ua398K\ufffd\ufffd \ufffdw:)\ufffdh\ufffd>\ufffd\u0284U\ufffdK\ufffd\ufffd9 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\tC\ufffdn\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffdf\ufffd\\k\ufffd\ufffd~\ufffd\ufffdc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 484164922c871ebd
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �k�6��T7��Ą�X�<���m 5n-d�O� !n �ϥ�x*f�Ic٪]j �D�DZ-���$��� �,�+̩�0�/̨ � � +
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �k�6��T7��Ą�X�<���m 5n-d�O�
!n �ϥ�x*f�Ic٪]j �D�DZ-���$��� �,�+̩�0�/̨ � �
+
Requête brute (extrait)
� �k�6��T7��Ą�X�<���m 5n-d�O� !n �ϥ�x*f�Ic٪]j �D�DZ-���$��� �,�+̩�0�/̨ � � + http/1.1 3 & $ ��t#���߷�gd���� j鳶�拚�͠�o - #
Meta JSON brut
{
"tls_ja3_hash": "484164922c871ebdb6030ae1de1d38a2",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.886512282148417,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "6908c4908828be75844992cfaa277eb43aae7225",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "484164922c871ebdb6030ae1de1d38a2",
"payload_hash": "7c36152042dbae9f75e96f5ac2e4dea8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e8ed20cb209312d59bc3558c4d6e1d13",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-10-43-5-13-16-51-45-35-11,29-23-24,0",
"tls_ja4_hash": "e8ed20cb209312d59bc3558c4d6e1d13",
"tls_ja4": "t13d0110_d21085683c38_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003k\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffd\u0013m\u001d5n-d\ufffdO\u0006\ufffd\n!n \ufffd\u03e5\ufffdx*\u0007f\ufffdI\u0001c\u000e\u066a]j\u001e\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003k\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffd\u0013m\u001d5n-d\ufffdO\u0006\ufffd\n!n \ufffd\u03e5\ufffdx*\u0007f\ufffdI\u0001c\u000e\u066a]j\u001e\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdt#\ufffd\ufffd\ufffd\u07f7\ufffdgd\ufffd\ufffd\u0016\ufffd\ufffd\fj\u9cf6\ufffd\u62da\ufffd\u0360\ufffdo\u000b\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003k\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffd\u0013m\u001d5n-d\ufffdO\u0006\ufffd\n!n \ufffd\u03e5\ufffdx*\u0007f\ufffdI\u0001c\u000e\u066a]j\u001e\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "841e22187be125f3530c90d88974e97223a617cf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003k\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffd\u0013m\u001d5n-d\ufffdO\u0006\ufffd\n!n \ufffd\u03e5\ufffdx*\u0007f\ufffdI\u0001c\u000e\u066a]j\u001e\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000",
"tls_ja3": "484164922c871ebdb6030ae1de1d38a2",
"tls_ja4": "e8ed20cb209312d59bc3558c4d6e1d13",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdk\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffdm5n-d\ufffdO\ufffd\n!n \ufffd\u03e5\ufffdx*f\ufffdIc\u066a]j\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+",
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003k\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffd\u0013m\u001d5n-d\ufffdO\u0006\ufffd\n!n \ufffd\u03e5\ufffdx*\u0007f\ufffdI\u0001c\u000e\u066a]j\u001e\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000",
"tls_ja3": "484164922c871ebdb6030ae1de1d38a2",
"tls_ja4": "e8ed20cb209312d59bc3558c4d6e1d13",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdk\ufffd6\ufffd\ufffdT7\ufffd\ufffd\u0104\ufffdX\ufffd<\ufffd\ufffd\ufffdm5n-d\ufffdO\ufffd\n!n \ufffd\u03e5\ufffdx*f\ufffdIc\u066a]j\ufffdD\ufffdDZ-\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b5887c4df50d8782
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ���j`���/�B��E��p�a��5b��iY �M�ٺ�y�n�Ly���Z�BP�R" �t�Qr �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���j`���/�B��E��p�a��5b��iY �M�ٺ�y�n�Ly���Z�BP�R" �t�Qr
�,�+̩�0�/̨ � �
Requête brute (extrait)
� ���j`���/�B��E��p�a��5b��iY �M�ٺ�y�n�Ly���Z�BP�R" �t�Qr �,�+̩�0�/̨ � � http/1.1 # - 3 & $ vX��V&��ƨ��=���(�������Pk�F�y +
Meta JSON brut
{
"tls_ja3_hash": "b5887c4df50d8782c9d4e75dc902e17b",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.9324665666543135,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "e9045cb5d56f5b7bd94528b788627a6998c90472",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b5887c4df50d8782c9d4e75dc902e17b",
"payload_hash": "1f4850174adcdf91702d71cc181ad916",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "509ef670cc3305b748859ce563c8d953",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-16-35-11-5-45-51-43-23-10,29-23-24,0",
"tls_ja4_hash": "509ef670cc3305b748859ce563c8d953",
"tls_ja4": "t13d0110_12d8b07ad1dd_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0015\ufffdj`\ufffd\ufffd\ufffd\u0004\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\u000e\ufffdp\ufffda\ufffd\ufffd5b\ufffd\u0013\ufffdiY \ufffd\u0002M\ufffd\u067a\u0003\ufffdy\ufffdn\ufffdLy\ufffd\u0006\ufffd\ufffdZ\ufffdBP\ufffdR\"\u001e\ufffdt\ufffdQr\n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0015\ufffdj`\ufffd\ufffd\ufffd\u0004\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\u000e\ufffdp\ufffda\ufffd\ufffd5b\ufffd\u0013\ufffdiY \ufffd\u0002M\ufffd\u067a\u0003\ufffdy\ufffdn\ufffdLy\ufffd\u0006\ufffd\ufffdZ\ufffdBP\ufffdR\"\u001e\ufffdt\ufffdQr\n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 vX\ufffd\ufffdV&\ufffd\ufffd\u01a8\ufffd\ufffd=\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\ufffdPk\ufffdF\u0019\ufffdy\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0015\ufffdj`\ufffd\ufffd\ufffd\u0004\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\u000e\ufffdp\ufffda\ufffd\ufffd5b\ufffd\u0013\ufffdiY \ufffd\u0002M\ufffd\u067a\u0003\ufffdy\ufffdn\ufffdLy\ufffd\u0006\ufffd\ufffdZ\ufffdBP\ufffdR\"\u001e\ufffdt\ufffdQr\n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22682082e1202b60fc7ecd644c3f655b6fe1b1e1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0015\ufffdj`\ufffd\ufffd\ufffd\u0004\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\u000e\ufffdp\ufffda\ufffd\ufffd5b\ufffd\u0013\ufffdiY \ufffd\u0002M\ufffd\u067a\u0003\ufffdy\ufffdn\ufffdLy\ufffd\u0006\ufffd\ufffdZ\ufffdBP\ufffdR\"\u001e\ufffdt\ufffdQr\n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "b5887c4df50d8782c9d4e75dc902e17b",
"tls_ja4": "509ef670cc3305b748859ce563c8d953",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj`\ufffd\ufffd\ufffd\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\ufffdp\ufffda\ufffd\ufffd5b\ufffd\ufffdiY \ufffdM\ufffd\u067a\ufffdy\ufffdn\ufffdLy\ufffd\ufffd\ufffdZ\ufffdBP\ufffdR\"\ufffdt\ufffdQr\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0015\ufffdj`\ufffd\ufffd\ufffd\u0004\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\u000e\ufffdp\ufffda\ufffd\ufffd5b\ufffd\u0013\ufffdiY \ufffd\u0002M\ufffd\u067a\u0003\ufffdy\ufffdn\ufffdLy\ufffd\u0006\ufffd\ufffdZ\ufffdBP\ufffdR\"\u001e\ufffdt\ufffdQr\n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "b5887c4df50d8782c9d4e75dc902e17b",
"tls_ja4": "509ef670cc3305b748859ce563c8d953",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj`\ufffd\ufffd\ufffd\u03a2\/\ufffdB\ufffd\ufffdE\ufffd\ufffdp\ufffda\ufffd\ufffd5b\ufffd\ufffdiY \ufffdM\ufffd\u067a\ufffdy\ufffdn\ufffdLy\ufffd\ufffd\ufffdZ\ufffdBP\ufffdR\"\ufffdt\ufffdQr\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 283fc13e19418489
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �W` �7b@�?"ݼBY�T�q�J�&��L�,��&' �Y��+4����GtB.�=&�{W:��!�\ �,�+̩�0�/̨ � � http/1.1 #
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �W` �7b@�?"ݼBY�T�q�J�&��L�,��&' �Y��+4����GtB.�=&�{W:��!�\ �,�+̩�0�/̨ � � http/1.1 #
Requête brute (extrait)
� �W` �7b@�?"ݼBY�T�q�J�&��L�,��&' �Y��+4����GtB.�=&�{W:��!�\ �,�+̩�0�/̨ � � http/1.1 # + 3 & $ \ .C�È��� ~������Y�<Q0 q߬YR -
Meta JSON brut
{
"tls_ja3_hash": "283fc13e194184898b29d3671abeea79",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.827832186600917,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "1274c6397e9bfa942871b511cb73b8b298ec4f8d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "283fc13e194184898b29d3671abeea79",
"payload_hash": "88bc8810c3065b52e9062e43e5eeef2d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "7f500eba5544b470c2f08aec6f6e8cfe",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-35-11-43-10-5-51-23-13-45,29-23-24,0",
"tls_ja4_hash": "7f500eba5544b470c2f08aec6f6e8cfe",
"tls_ja4": "t13d0110_f1304cb57d14_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\u0003\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\u0003\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\u0003\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\u0003\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \\\t.C\ufffd\u00c8\ufffd\ufffd\ufffd\t~\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd<Q0\u0000q\u07ecY\u0004R\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\u0003\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\u0003\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e4468fde2ff76657950ff5407e4252d59a5c250a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\u0003\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\u0003\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"tls_ja3": "283fc13e194184898b29d3671abeea79",
"tls_ja4": "7f500eba5544b470c2f08aec6f6e8cfe",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdW`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1#",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\u0003\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\u0003\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"tls_ja3": "283fc13e194184898b29d3671abeea79",
"tls_ja4": "7f500eba5544b470c2f08aec6f6e8cfe",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdW`\t\ufffd7b@\ufffd?\"\u077cBY\ufffdT\ufffdq\ufffdJ\ufffd&\ufffd\ufffdL\ufffd,\ufffd\ufffd&' \ufffdY\ufffd\ufffd+4\ufffd\ufffd\ufffd\ufffdGtB.\ufffd=&\ufffd{W:\ufffd\ufffd!\ufffd\\\u0096\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1#",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d3c03017a6f65758
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ���BpO!,�O#�3�'�lG�5C��d��� �U���[0�u��}���0�6��m��,�T��\� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���BpO!,�O#�3�'�lG�5C��d��� �U���[0�u��}���0�6��m��,�T��\� �,�+̩�0�/̨ � �
Requête brute (extrait)
� ���BpO!,�O#�3�'�lG�5C��d��� �U���[0�u��}���0�6��m��,�T��\� �,�+̩�0�/̨ � � - 3 & $ D�X&�˄0�~*/t0WqH��o�����F http/1.1 # +
Meta JSON brut
{
"tls_ja3_hash": "d3c03017a6f65758874912f8ff666665",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.868865980565654,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "16437d423dccf042abd9365ff2be6111be7d58f9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d3c03017a6f65758874912f8ff666665",
"payload_hash": "69565b608d945491f5dc04e7adbcdaf9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "dc0aa6c761252157f7ba2c94d3845918",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-5-11-45-10-51-16-35-43,29-23-24,0",
"tls_ja4_hash": "dc0aa6c761252157f7ba2c94d3845918",
"tls_ja4": "t13d0110_264f4deef16a_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0004Bp\u0011O!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\u0002\ufffd\ufffdd\ufffd\ufffd\u0002\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd\u00136\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0004Bp\u0011O!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\u0002\ufffd\ufffdd\ufffd\ufffd\u0002\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd\u00136\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u00003\u0000&\u0000$\u0000\u001d\u0000 D\ufffdX&\ufffd\u02c40\ufffd~*\u0010\/t0\u0003WqH\ufffd\u0012\ufffdo\ufffd\u0001\ufffd\ufffd\ufffd\ufffdF\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0004Bp\u0011O!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\u0002\ufffd\ufffdd\ufffd\ufffd\u0002\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd\u00136\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd75dfe7f25f3d2bf1a3c8a14b6ff690deb201c3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0004Bp\u0011O!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\u0002\ufffd\ufffdd\ufffd\ufffd\u0002\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd\u00136\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "d3c03017a6f65758874912f8ff666665",
"tls_ja4": "dc0aa6c761252157f7ba2c94d3845918",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdBpO!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\ufffd\ufffdd\ufffd\ufffd\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd6\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0004Bp\u0011O!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\u0002\ufffd\ufffdd\ufffd\ufffd\u0002\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd\u00136\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "d3c03017a6f65758874912f8ff666665",
"tls_ja4": "dc0aa6c761252157f7ba2c94d3845918",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdBpO!,\ufffdO#\ufffd3\ufffd'\ufffdlG\ufffd5C\ufffd\ufffdd\ufffd\ufffd\ufffd \ufffdU\ufffd\ufffd\ufffd[0\ufffdu\ufffd\ufffd}\ufffd\ufffd\ufffd0\ufffd6\ufffd\ufffdm\ufffd\ufffd,\ufffdT\ufffd\ufffd\\\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 723d6acf78498d2b
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ��pe#�s���5]M��z_ ������6?� �n�:�6"(�-�.uP��K_0_�Ji�Q�Q� �,�+̩�0�/̨ � � + # -
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��pe#�s���5]M��z_
������6?� �n�:�6"(�-�.uP��K_0_�Ji�Q�Q� �,�+̩�0�/̨ � � + # -
Requête brute (extrait)
� ��pe#�s���5]M��z_ ������6?� �n�:�6"(�-�.uP��K_0_�Ji�Q�Q� �,�+̩�0�/̨ � � + # - 3 & $ (u1_} b�A���1�P�g�4 i� �f� http/1.1
Meta JSON brut
{
"tls_ja3_hash": "723d6acf78498d2b2c5bbf33cf269fc3",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.795328764881029,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "ef8335391af5c09f53ada9d64aa85c0e6a0b1a65",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "723d6acf78498d2b2c5bbf33cf269fc3",
"payload_hash": "6ff53c189345398f25af667839cc86bd",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "b215046ae8d25d116185112f6a36ac08",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-35-45-10-13-23-51-11-16-5,29-23-24,0",
"tls_ja4_hash": "b215046ae8d25d116185112f6a36ac08",
"tls_ja4": "t13d0110_23f4f2ad08a9_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdpe#\ufffd\u0016s\ufffd\ufffd\ufffd5]M\ufffd\u0012\ufffdz_\n\ufffd\u0005\u0004\ufffd\ufffd\ufffd\u0019\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.\u000fuP\u0012\ufffd\ufffdK_0_\ufffdJi\u0014\u000f\ufffdQ\ufffdQ\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdpe#\ufffd\u0016s\ufffd\ufffd\ufffd5]M\ufffd\u0012\ufffdz_\n\ufffd\u0005\u0004\ufffd\ufffd\ufffd\u0019\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.\u000fuP\u0012\ufffd\ufffdK_0_\ufffdJi\u0014\u000f\ufffdQ\ufffdQ\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 (u\u000e1\u0010_}\tb\ufffdA\ufffd\ufffd\ufffd1\ufffdP\ufffdg\ufffd4\r\u001f\u001fi\ufffd\r\f\ufffdf\ufffd\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdpe#\ufffd\u0016s\ufffd\ufffd\ufffd5]M\ufffd\u0012\ufffdz_\n\ufffd\u0005\u0004\ufffd\ufffd\ufffd\u0019\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.\u000fuP\u0012\ufffd\ufffdK_0_\ufffdJi\u0014\u000f\ufffdQ\ufffdQ\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a7fcf57c6e42996a0b7e52ec34229b2ee2b4ec6b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdpe#\ufffd\u0016s\ufffd\ufffd\ufffd5]M\ufffd\u0012\ufffdz_\n\ufffd\u0005\u0004\ufffd\ufffd\ufffd\u0019\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.\u000fuP\u0012\ufffd\ufffdK_0_\ufffdJi\u0014\u000f\ufffdQ\ufffdQ\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "723d6acf78498d2b2c5bbf33cf269fc3",
"tls_ja4": "b215046ae8d25d116185112f6a36ac08",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdpe#\ufffds\ufffd\ufffd\ufffd5]M\ufffd\ufffdz_\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.uP\ufffd\ufffdK_0_\ufffdJi\ufffdQ\ufffdQ\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#-",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdpe#\ufffd\u0016s\ufffd\ufffd\ufffd5]M\ufffd\u0012\ufffdz_\n\ufffd\u0005\u0004\ufffd\ufffd\ufffd\u0019\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.\u000fuP\u0012\ufffd\ufffdK_0_\ufffdJi\u0014\u000f\ufffdQ\ufffdQ\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "723d6acf78498d2b2c5bbf33cf269fc3",
"tls_ja4": "b215046ae8d25d116185112f6a36ac08",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdpe#\ufffds\ufffd\ufffd\ufffd5]M\ufffd\ufffdz_\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd6?\ufffd \ufffdn\ufffd:\ufffd6\"(\ufffd-\ufffd.uP\ufffd\ufffdK_0_\ufffdJi\ufffdQ\ufffdQ\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#-",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 205ec48488baee07
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �r��D9~Hs�� ��g|,��� �ok��o x ������i���l_Ç �a����Zö: �,�+̩�0�/̨ � � - #
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �r��D9~Hs�� ��g|,���
�ok��o x
������i���l_Ç �a����Zö: �,�+̩�0�/̨ � � -
#
Requête brute (extrait)
� �r��D9~Hs�� ��g|,��� �ok��o x ������i���l_Ç �a����Zö: �,�+̩�0�/̨ � � - # http/1.1 3 & $ ��%��`!��`&��^���,�V�Z�4��i +
Meta JSON brut
{
"tls_ja3_hash": "205ec48488baee07afdfb84659f7038d",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.869429555544619,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "644a31be5a6e32fdcbe8f666255e4a4725d1ae5f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "205ec48488baee07afdfb84659f7038d",
"payload_hash": "26d93e7b8271d02a360c28d0ad86155b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "8201080ec9c7fdb2129d566214e4660f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-10-35-16-51-23-5-43-13,29-23-24,0",
"tls_ja4_hash": "8201080ec9c7fdb2129d566214e4660f",
"tls_ja4": "t13d0110_570afde31bc5_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013r\ufffd\ufffdD9~Hs\ufffd\ufffd\f\ufffd\ufffdg|\b\u0012,\ufffd\u0005\u0014\ufffd\ufffd\n\u0006\ufffdok\ufffd\ufffdo x\n\ufffd\u0010\ufffd\ufffd\u0012\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u0004\u00c7\u000b\u0011\u000b\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013r\ufffd\ufffdD9~Hs\ufffd\ufffd\f\ufffd\ufffdg|\b\u0012,\ufffd\u0005\u0014\ufffd\ufffd\n\u0006\ufffdok\ufffd\ufffdo x\n\ufffd\u0010\ufffd\ufffd\u0012\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u0004\u00c7\u000b\u0011\u000b\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd%\ufffd\ufffd`!\ufffd\u0011\ufffd`&\ufffd\ufffd^\ufffd\ufffd\ufffd\u0014,\ufffdV\ufffd\u0004Z\ufffd4\ufffd\ufffdi\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013r\ufffd\ufffdD9~Hs\ufffd\ufffd\f\ufffd\ufffdg|\b\u0012,\ufffd\u0005\u0014\ufffd\ufffd\n\u0006\ufffdok\ufffd\ufffdo x\n\ufffd\u0010\ufffd\ufffd\u0012\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u0004\u00c7\u000b\u0011\u000b\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e2456a8f116aa0819fa1c329aa06f05caabb080",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013r\ufffd\ufffdD9~Hs\ufffd\ufffd\f\ufffd\ufffdg|\b\u0012,\ufffd\u0005\u0014\ufffd\ufffd\n\u0006\ufffdok\ufffd\ufffdo x\n\ufffd\u0010\ufffd\ufffd\u0012\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u0004\u00c7\u000b\u0011\u000b\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#",
"tls_ja3": "205ec48488baee07afdfb84659f7038d",
"tls_ja4": "8201080ec9c7fdb2129d566214e4660f",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdr\ufffd\ufffdD9~Hs\ufffd\ufffd\ufffd\ufffdg|,\ufffd\ufffd\ufffd\n\ufffdok\ufffd\ufffdo x\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u00c7\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\n#",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013r\ufffd\ufffdD9~Hs\ufffd\ufffd\f\ufffd\ufffdg|\b\u0012,\ufffd\u0005\u0014\ufffd\ufffd\n\u0006\ufffdok\ufffd\ufffdo x\n\ufffd\u0010\ufffd\ufffd\u0012\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u0004\u00c7\u000b\u0011\u000b\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#",
"tls_ja3": "205ec48488baee07afdfb84659f7038d",
"tls_ja4": "8201080ec9c7fdb2129d566214e4660f",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdr\ufffd\ufffdD9~Hs\ufffd\ufffd\ufffd\ufffdg|,\ufffd\ufffd\ufffd\n\ufffdok\ufffd\ufffdo x\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffdl_\u00c7\ufffda\ufffd\ufffd\ufffd\ufffdZ\u00f6:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\n#",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 0477925695877c7c
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ����Yh�B#풍���p�&�Oڨ��� t ^ �s"`ں�|A˴� �^+L�h� � �$D����~ �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����Yh�B#풍���p�&�Oڨ��� t
^ �s"`ں�|A˴�
�^+L�h� � �$D����~ �,�+̩�0�/̨ � �
Requête brute (extrait)
� ����Yh�B#풍���p�&�Oڨ��� t ^ �s"`ں�|A˴� �^+L�h� � �$D����~ �,�+̩�0�/̨ � � 3 & $ ����]��v��f�UӪp�WF�s��� l - http/1.1 + #
Meta JSON brut
{
"tls_ja3_hash": "0477925695877c7cea955ea82bf865f8",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.8146233697998655,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "71b99bb79d53a41113cf323add4f6b816ed4d13c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "0477925695877c7cea955ea82bf865f8",
"payload_hash": "64872bd6b786a624e482e826ab366c98",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "6ca94e3e69d4a08512c53dae297fb2a7",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-23-51-45-10-16-43-11-35-5,29-23-24,0",
"tls_ja4_hash": "6ca94e3e69d4a08512c53dae297fb2a7",
"tls_ja4": "t13d0110_c4be628ad5fb_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\u0002\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\u0001\ufffd t\n^\u0000 \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\u0016\ufffd^+L\ufffdh\ufffd\u001e\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\u0002\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\u0001\ufffd t\n^\u0000 \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\u0016\ufffd^+L\ufffdh\ufffd\u001e\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002\u0016\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffdv\u000f\ufffd\ufffdf\ufffdU\u0001\u04eap\ufffdWF\ufffds\ufffd\ufffd\ufffd\u001cl\u001d\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\u0002\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\u0001\ufffd t\n^\u0000 \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\u0016\ufffd^+L\ufffdh\ufffd\u001e\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d818948fa96d70b9abcff86f068d0d4856d568b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\u0002\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\u0001\ufffd t\n^\u0000 \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\u0016\ufffd^+L\ufffdh\ufffd\u001e\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "0477925695877c7cea955ea82bf865f8",
"tls_ja4": "6ca94e3e69d4a08512c53dae297fb2a7",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\ufffd t\n^ \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\ufffd^+L\ufffdh\ufffd\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\u0002\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\u0001\ufffd t\n^\u0000 \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\u0016\ufffd^+L\ufffdh\ufffd\u001e\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "0477925695877c7cea955ea82bf865f8",
"tls_ja4": "6ca94e3e69d4a08512c53dae297fb2a7",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdYh\ufffdB#\ud48d\ufffd\ufffd\ufffdp\ufffd&\ufffdO\u06a8\ufffd\ufffd\ufffd t\n^ \ufffds\"`\u06ba\ufffd|A\u02f4\ufffd\n\ufffd^+L\ufffdh\ufffd\ufffd \ufffd$D\ufffd\ufffd\ufffd\ufffd~\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a767bc9c16921db9
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �u�V���o�f�N��ț�B��{>p�!! R��m�7/mQ��>ԉ��İ�n� ��2N� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �u�V���o�f�N��ț�B��{>p�!! R��m�7/mQ��>ԉ��İ�n� ��2N� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �u�V���o�f�N��ț�B��{>p�!! R��m�7/mQ��>ԉ��İ�n� ��2N� �,�+̩�0�/̨ � � http/1.1 - 3 & $ �� ������'s���Y\ |�[��=Wn�O/ + #
Meta JSON brut
{
"tls_ja3_hash": "a767bc9c16921db96629c78620cf0875",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.930954002436055,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "b4938fc14320696877d69aefb6b737a9f0ace256",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a767bc9c16921db96629c78620cf0875",
"payload_hash": "a510fdeab00d85299e40b0b4e402ee80",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "43ac569561410bc95e4c02c6b3f7a1a7",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-16-45-51-43-23-11-10-35-5,29-23-24,0",
"tls_ja4_hash": "43ac569561410bc95e4c02c6b3f7a1a7",
"tls_ja4": "t13d0110_1fde23b4d2f9_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffdV\ufffd\ufffd\ufffd\u0012o\ufffdf\b\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd\u0019\u0015{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/m\u000f\u0007Q\u001b\ufffd\ufffd\u0006\u0015>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\u001e\ufffd\ufffd2N\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffdV\ufffd\ufffd\ufffd\u0012o\ufffdf\b\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd\u0019\u0015{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/m\u000f\u0007Q\u001b\ufffd\ufffd\u0006\u0015>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\u001e\ufffd\ufffd2N\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u001f\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd's\u0007\ufffd\ufffd\ufffdY\\\t|\u000e\ufffd[\ufffd\ufffd\u0002=Wn\ufffdO\/\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffdV\ufffd\ufffd\ufffd\u0012o\ufffdf\b\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd\u0019\u0015{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/m\u000f\u0007Q\u001b\ufffd\ufffd\u0006\u0015>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\u001e\ufffd\ufffd2N\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5dfd275c68cebd59ae06f2e12b6af246ba4ac7b6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffdV\ufffd\ufffd\ufffd\u0012o\ufffdf\b\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd\u0019\u0015{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/m\u000f\u0007Q\u001b\ufffd\ufffd\u0006\u0015>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\u001e\ufffd\ufffd2N\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "a767bc9c16921db96629c78620cf0875",
"tls_ja4": "43ac569561410bc95e4c02c6b3f7a1a7",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdu\ufffdV\ufffd\ufffd\ufffdo\ufffdf\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/mQ\ufffd\ufffd>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\ufffd\ufffd2N\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffdV\ufffd\ufffd\ufffd\u0012o\ufffdf\b\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd\u0019\u0015{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/m\u000f\u0007Q\u001b\ufffd\ufffd\u0006\u0015>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\u001e\ufffd\ufffd2N\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "a767bc9c16921db96629c78620cf0875",
"tls_ja4": "43ac569561410bc95e4c02c6b3f7a1a7",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdu\ufffdV\ufffd\ufffd\ufffdo\ufffdf\ufffdN\ufffd\ufffd\u021b\ufffdB\ufffd\ufffd{\uf723>p\ufffd!! R\ufffd\ufffdm\ufffd7\/mQ\ufffd\ufffd>\u0509\ufffd\ufffd\u0130\ufffdn\ufffd\ufffd\ufffd2N\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a05ff6f51d9ad1be
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� ����S �.LƇ����+pI��V��� �9M�M� ��˹ˢ��P=p��g��d�x�g��)��u �,�+̩�0�/̨ � � # +
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����S �.LƇ����+pI��V���
�9M�M�
��˹ˢ��P=p��g��d�x�g��)��u �,�+̩�0�/̨ � � # +
Requête brute (extrait)
� ����S �.LƇ����+pI��V��� �9M�M� ��˹ˢ��P=p��g��d�x�g��)��u �,�+̩�0�/̨ � � # + - 3 & $ �o��MN�0�� 33�<�D�<J��g#Y<Ix��= http/1.1
Meta JSON brut
{
"tls_ja3_hash": "a05ff6f51d9ad1bea7a0fa76f03a6e55",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.808421746594747,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "862c48e18543dd125ed0f40704a058be7a82f223",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a05ff6f51d9ad1bea7a0fa76f03a6e55",
"payload_hash": "6eb967a7d0f4eb02cf7531e52bd0ee30",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "4b8455f49ec2e51c56a5f34cf2164303",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-43-10-45-11-5-13-51-16-23,29-23-24,0",
"tls_ja4_hash": "4b8455f49ec2e51c56a5f34cf2164303",
"tls_ja4": "t13d0110_20badc777136_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdS\u001c\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+\u0018pI\u0012\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \u0019\n\ufffd\u0002\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdS\u001c\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+\u0018pI\u0012\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \u0019\n\ufffd\u0002\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdo\ufffd\u0001\ufffdMN\ufffd0\ufffd\ufffd\u001e33\ufffd<\ufffdD\ufffd<J\ufffd\ufffdg#Y<Ix\ufffd\ufffd=\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdS\u001c\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+\u0018pI\u0012\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \u0019\n\ufffd\u0002\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e6a1ae23fc57ae3680b302107d5dba6ef552f11",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdS\u001c\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+\u0018pI\u0012\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \u0019\n\ufffd\u0002\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "a05ff6f51d9ad1bea7a0fa76f03a6e55",
"tls_ja4": "4b8455f49ec2e51c56a5f34cf2164303",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+pI\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \n\ufffd\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdS\u001c\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+\u0018pI\u0012\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \u0019\n\ufffd\u0002\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "a05ff6f51d9ad1bea7a0fa76f03a6e55",
"tls_ja4": "4b8455f49ec2e51c56a5f34cf2164303",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd.L\u0187\ufffd\ufffd\ufffd\ufffd+pI\ufffd\ufffdV\ufffd\ufffd\ufffd\r\ufffd9M\ufffdM\ufffd \n\ufffd\ufffd\u02f9\u02e2\ufffd\ufffdP=p\ufffd\ufffdg\ufffd\ufffdd\ufffdx\ufffdg\ufffd\ufffd)\ufffd\ufffdu\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 06e99f06e5102707
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
� �Wt��pO�����l"������Yrk8@�Fm� �;4Z�.i�#e0!u���5 B�+�i�L��7 �,�+̩�0�/̨ � � 3 & $ ��<����S �� C
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Wt��pO�����l"������Yrk8@�Fm� �;4Z�.i�#e0!u���5 B�+�i�L��7 �,�+̩�0�/̨ � � 3 & $ ��<����S �� C
Requête brute (extrait)
� �Wt��pO�����l"������Yrk8@�Fm� �;4Z�.i�#e0!u���5 B�+�i�L��7 �,�+̩�0�/̨ � � 3 & $ ��<����S �� C$\�|C#��C���m/� - # http/1.1 +
Meta JSON brut
{
"tls_ja3_hash": "06e99f06e51027077e93246e43ffd07b",
"tls_sni": null,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 241,
"payload_entropy": 5.810030109926304,
"port_category": "well_known",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935",
"event_fingerprint": "53ea8e72010ae6e6e5422cc7c348b56e790fe6cc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "06e99f06e51027077e93246e43ffd07b",
"payload_hash": "585104676d6e8812fdd370baf6c61c8e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "8936818e12c63bfbc0e74e0057d4f4fe",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-11-13-45-10-35-16-5-43-23,29-23-24,0",
"tls_ja4_hash": "8936818e12c63bfbc0e74e0057d4f4fe",
"tls_ja4": "t13d0110_8e2052b7ea22_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffd\u0018l\"\ufffd\ufffd\ufffd\u0012\u0016\ufffd\ufffd\ufffdYrk\u00178@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5\u0005\u001dB\ufffd+\ufffdi\ufffdL\ufffd\ufffd\u0013\u00057\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u0019S\u001d\u0002\ufffd\ufffd\u000bC\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffd\u0018l\"\ufffd\ufffd\ufffd\u0012\u0016\ufffd\ufffd\ufffdYrk\u00178@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5\u0005\u001dB\ufffd+\ufffdi\ufffdL\ufffd\ufffd\u0013\u00057\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u0019S\u001d\u0002\ufffd\ufffd\u000bC\u0002$\\\ufffd|C#\ufffd\ufffdC\ufffd\ufffd\ufffdm\/\ufffd\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffd\u0018l\"\ufffd\ufffd\ufffd\u0012\u0016\ufffd\ufffd\ufffdYrk\u00178@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5\u0005\u001dB\ufffd+\ufffdi\ufffdL\ufffd\ufffd\u0013\u00057\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u0019S\u001d\u0002\ufffd\ufffd\u000bC\u0002",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bef84ec45e401f5037e0e025913ffaa30b6058aa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffd\u0018l\"\ufffd\ufffd\ufffd\u0012\u0016\ufffd\ufffd\ufffdYrk\u00178@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5\u0005\u001dB\ufffd+\ufffdi\ufffdL\ufffd\ufffd\u0013\u00057\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u0019S\u001d\u0002\ufffd\ufffd\u000bC\u0002",
"tls_ja3": "06e99f06e51027077e93246e43ffd07b",
"tls_ja4": "8936818e12c63bfbc0e74e0057d4f4fe",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdWt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffdl\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdYrk8@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5B\ufffd+\ufffdi\ufffdL\ufffd\ufffd7\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffdC",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffd\u0018l\"\ufffd\ufffd\ufffd\u0012\u0016\ufffd\ufffd\ufffdYrk\u00178@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5\u0005\u001dB\ufffd+\ufffdi\ufffdL\ufffd\ufffd\u0013\u00057\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u0019S\u001d\u0002\ufffd\ufffd\u000bC\u0002",
"tls_ja3": "06e99f06e51027077e93246e43ffd07b",
"tls_ja4": "8936818e12c63bfbc0e74e0057d4f4fe",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdWt\ufffd\ufffdpO\ufffd\ufffd\ufffd\ufffd\ufffdl\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdYrk8@\ufffdFm\ufffd \ufffd;4Z\ufffd.i\ufffd#e0!u\ufffd\ufffd\ufffd5B\ufffd+\ufffdi\ufffdL\ufffd\ufffd7\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffdC",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /www/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "7b5c6d1b9506a8d5fe958dbcf1ffdcdd61f34f9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "d09c672506d72ebb03b51e880465d71ae3cb348e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "af4b4409c875f90c128a018e8b712845",
"path_pattern_hash": "2067f182832f5bbc5f3205656471af53"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06b83454270eeb6cfd1fd0e8071b9fb595bea887",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /site/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /site/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/site/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/site/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /site/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /site/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "99d75e39037b11054e155a03133c80282ea1c965",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 101,
"payload_entropy": 4.9368081174021965,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "53ddd2737bf837cf257e9169f79f9c0449715171",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "ddc8f8507d7372d35c6a44f6fbd05298",
"path_pattern_hash": "6901c63c2daa99b93d9d7c027371b852"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c30441eb2cac367cb9abd8743c7aea2454d19d9b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /public/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /public/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/public/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/public/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /public/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "8257582ae447b9a2124e0414764cac0aac8808de",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 5.021729843933261,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "b9b9b325e2909e914563b73ecd02417e8db4d3c5",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "bc4fb4ef96d1cf89c362923d47ab527c",
"path_pattern_hash": "78b85c05b86f9869fecb7907511b414c"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "063726c87f0b83e30ebe024fa6d45e211e17ecb3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /wordpress/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /wordpress/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/wordpress/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/wordpress/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /wordpress/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /wordpress/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "466d1ef9599315e8ea185d729b1bb7f4ef3f3e3e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 4.950620370827833,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "8c0571e124adc0d1a65e5375d251adc574fee006",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "bcf75c1f9068465de7c8c54adc363f41",
"path_pattern_hash": "065fde2a84971d9e936ccb4d03006f9c"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c244d3d23b821707b6d507916d3988e09933d19",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /app/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/app/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/app/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /app/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "c0d576333b61f38bb5785040d2824435407a4c84",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "088177a2ffc000e57be2f309a00e22fd23b4e08e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "c167cb7993ec0531b414c344dc1df914",
"path_pattern_hash": "87d63e686c8d80bd28afc993649c7598"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c92d46762e737f98bf8ff2bb257e786648e85f79",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /htdocs/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /htdocs/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/htdocs/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/htdocs/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /htdocs/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /htdocs/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "91751256d60394a8b0340bb86ad1a8313b8dadfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.957748383100416,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "7ce2a2bdc256d1e911287c08d33abbaa4150f0f2",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "c1d5f448538c27e1c05268aa68c84ddb",
"path_pattern_hash": "9d5b4b02a118c63f9864fb4303c2c2fa"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "899fff85d306fcd8f30861be8680d328aedeadb9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0198
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.git/config
Ligne de requête
GET /.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 96,
"payload_entropy": 4.955255934407698,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d8d58664fe17ae111c540add11fabfc91d27bc2a",
"event_fingerprint": "1555e6f278c69c5cc6896e9076ddbbd952184f91",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0198"
],
"matched_pattern_names": [
"Probe \/.git\/config"
],
"pattern_ids": [
"pat-0198"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "1c0e76faf9a1f6d2f8e0e1a934dd8ea4",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40edf7378532ca4527b8380f9ce37f784577283b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0198",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /var/www/.git/config
|
Élevée
|
Élevé · 67
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950312:lfi-13
950468:nosqli-3
950513:leak-0
http_backup_file_scan
Cible HTTP
GET
/var/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/var/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-13 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /var/www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
lfi-13
nosqli-3
leak-0
Payload (extrait)
GET /var/www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "5bc04837a815dc3b9c63afd166a20d43881e48d8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 4.973142397239314,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 96,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b5a2cb2be65dee167b8b722ee456a816ddc3db11",
"event_fingerprint": "e50c0639cd3efe5f4aea698d71672104809187fe",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "79add9695dbcca057876adf5e946fbe9",
"path_pattern_hash": "3bba9c9f0da0327b3f567a33822f22e3"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7af8ddfa803a003a00c01eb1dd8118293ed7f97",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /backend/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/backend/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/backend/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /backend/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "2482ac6c987d570b89dfba6cfee3dc3ac194789d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 4.990230680638121,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "698a7117ab821500584af761919bd374b0335f41",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "4ab49a87d4c824b12e4d8d44dc676286",
"path_pattern_hash": "2de751ea5a34e7a22b69004dc29faa62"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84cb5f39757cf7393ddc1d3eaf59140ff5aae18f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /api/.git/config
|
Élevée
|
Moyen · 62
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
18
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
950600:k8s-api
http_backup_file_scan
Cible HTTP
GET
/api/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/api/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
k8s-api
Payload (extrait)
GET /api/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 80,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 62,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "20fad474cda75366905b38f65ff1a91f6a24469a",
"event_fingerprint": "660c59b4312bd640d716087fc1d8a895945ff293",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "992210d84643d1081e7ba4352d2b1055",
"path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "468386fbf644cb4afb166b3fdea2486d3b74b33c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 80 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_api",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /src/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/src/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/src/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /src/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "46e050e820087702ef14a381ebad48881db62e31",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 4.932787665793271,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "64e55b39f24459900373f55c3eafcce262df40b8",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "1471a03bb16353cddecea74757a3f1f8",
"path_pattern_hash": "83762003e224a5603ed7ad8ff32c59fc"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35b254d268699a2df57ec0f5f9c85470677fc7f0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
82 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:82 · (tentative d'exploit) · → /html/.git/config
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /html/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/html/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/html/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /html/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /html/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:82
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "ed148acba970ce3061829b4dd97608d1a6997773",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 101,
"payload_entropy": 5.015027271163485,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a655505342ca0a49ed83eb96dc7a3f29645912eb",
"event_fingerprint": "12f10aaac4088891f8e4d94633b47eb4c909fbbb",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "43f66d0923f6a26441fe6d41db26c4a9",
"path_pattern_hash": "985e825857a4aae20b7bcc62b05870c4"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"evidence": {
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35e0717d331acba1528696b942b683c22b963c1a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|