|
|
TCP |
5059 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5059 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 eca344c886047da5
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5059
Chemin / cible
—
Service
TLS
Payload
����-����]������v��b��F����o� _���'��N���.Gg'M� v����q�! пZ5 ���+�/�,�0̨̩�� � � / 5 �JJ
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0607
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����-����]������v��b��F����o� _���'��N���.Gg'M� v����q�! пZ5 ���+�/�,�0̨̩�� � � / 5 �JJ
Requête brute (extrait)
����-����]������v��b��F����o� _���'��N���.Gg'M� v����q�! пZ5 ���+�/�,�0̨̩�� � � / 5 �JJ ��c� � � �w~,��,�}筝 �|/��=&� _<��n� �8��_�JbfQ}{X��v,R1��A�iRͻ��_J� [���� �� ���]J��8�T�H٤K �^
Meta JSON brut
{
"tls_ja3_hash": "eca344c886047da5bc71f171c00dcdc4",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1797,
"payload_entropy": 7.745180709324561,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5059,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d71f6d047e6aa7b25e39689379c4fb261c54909d",
"event_fingerprint": "3dcbf0e9c748fe3eb5e4bcf97faf1973d0e7cfcb",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0607"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "eca344c886047da5bc71f171c00dcdc4",
"payload_hash": "1b1bab587fc2be738be62fc936ffd400",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5059,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0016\ufffd\u0006\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffdv\ufffd\ufffdb\u0012\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\u0004\ufffdq\ufffd!\u001f\u043fZ5\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffdJJ\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0016\ufffd\u0006\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffdv\ufffd\ufffdb\u0012\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\u0004\ufffdq\ufffd!\u001f\u043fZ5\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffdJJ\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffdw\u0005~,\ufffd\ufffd,\ufffd}\u7b5d\f\ufffd|\/\ufffd\ufffd=&\ufffd\n_<\ufffd\ufffdn\u001a\ufffd\u001e\u0000\ufffd8\ufffd\ufffd\u0001_\ufffdJbfQ}{X\ufffd\ufffdv,R\u00071\ufffd\ufffdA\ufffdi\u001bR\u037b\u000e\ufffd\ufffd_J\ufffd\n[\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\ufffd\u001d\ufffd\ufffd\ufffd]\u0019\u0017J\ufffd\ufffd8\ufffdT\ufffdH\u0664K \ufffd^",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0016\ufffd\u0006\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffdv\ufffd\ufffdb\u0012\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\u0004\ufffdq\ufffd!\u001f\u043fZ5\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffdJJ\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5edb6637252a0d23b5c9c1cbd3e248c587d5b007",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0016\ufffd\u0006\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffdv\ufffd\ufffdb\u0012\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\u0004\ufffdq\ufffd!\u001f\u043fZ5\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffdJJ\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"tls_ja3": "eca344c886047da5bc71f171c00dcdc4",
"port": 5059,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffdb\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\ufffdq\ufffd!\u043fZ5 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJ",
"attack_vector": "tls probe \u00b7 via TLS:5059 \u00b7 (sonde \/ probe)",
"target_port_label": "5059 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5059,
"protocol_emulated": null,
"tags_summary": [
"pat-0607"
],
"tags_summary_labels_fr": [
"pat-0607"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0016\ufffd\u0006\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffdv\ufffd\ufffdb\u0012\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\u0004\ufffdq\ufffd!\u001f\u043fZ5\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffdJJ\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"tls_ja3": "eca344c886047da5bc71f171c00dcdc4",
"port": 5059,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5059 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffdb\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffdo\ufffd _\ufffd\ufffd\ufffd'\ufffd\ufffdN\ufffd\ufffd\ufffd.Gg'M\ufffd\tv\ufffd\ufffd\ufffd\ufffdq\ufffd!\u043fZ5 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJ",
"target_port_label": "5059 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5059"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:5059",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5059
|
—
|
Sonde port
Sonde port · port 5059 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5059
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 5059,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b80c47664efd9c93f077cddf243ffee43bc9be03",
"event_fingerprint": "f6cae418d36fbb13e8f4a9089ca94eab9c7497e4",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5059,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e04083e51d2df86c75568ca8cd2599a1575705e2",
"protocol_details": {
"port": 5059
},
"attack_vector": "Sonde port \u00b7 port 5059 \u00b7 (sonde \/ probe)",
"target_port_label": "5059",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5059,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5059
},
"attack_vector": "Sonde port \u00b7 port 5059 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5059",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5059"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
oracle tns probe
oracle tns probe · via ORACLE EM:7443 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_em_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": "oracle-em",
"app_proto": "oracle-em",
"asn": 396982,
"country": "US",
"dst_port": 7443,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a0fb4e230f74128288b97013feb2ed16cb862a7f",
"event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6",
"classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "oracle-em",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "420e91c120535c16728a9791d446fafc"
},
"target_context": {
"dst_port": 7443,
"service": "oracle-em",
"service_name": "oracle-em",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c4519cd1dca2b5273c95d709ed4a537ae928709",
"protocol_details": {
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)",
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "oracle-em",
"service_label_fr": "ORACLE EM",
"dst_port": 7443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-oracle-em",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7443,
"service": "oracle-em",
"service_label_fr": "ORACLE EM"
},
"attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7443 \u00b7 ORACLE EM",
"emulator_service": "oracle-em",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "oracle_em",
"service_banner": "honeypot-oracle-em",
"service_os": "linux",
"dst_port": "7443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_oracle_tns_probe",
"oracle_em_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5076 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:5076 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5076
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5076
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Reque
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5076 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6376d7608bf08bdbc1e74c51b264e56bdd20ad52",
"http_host_hash": "9189b25c8647722aef7b17e8449d15d4aaaccdd9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 456,
"payload_entropy": 5.471452704672546,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 5076,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "851a7064f415311c0413d1e5756d61d50fdbf8b9",
"event_fingerprint": "d896862578daf6cbd8fd9838c0571d23e5040962",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b17f14f4076f751bfda0c766a7303e14",
"payload_hash": "b0ef1c2190a5489c6c25023395da185d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5076,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5330f5e31abf98fc7952daaeb6c017a1f660517f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 5076,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"attack_vector": "exploit attempt \u00b7 via HTTP:5076 \u00b7 (tentative d'exploit)",
"target_port_label": "5076 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5076,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 5076,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:5076 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5076\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"target_port_label": "5076 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5076"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5080 · TLS
|
tls
|
Sonde Kafka
kafka probe · via TLS:5080 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 f5b1b86cf354c66b
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5080
Chemin / cible
—
Service
TLS
Payload
� ���V�o#�F�͈�c D���7k��ũ5�0��;� ��a���<���� r��؝O���Ӊ:��� ���+�/�,�0̨̩�� � � / 5 S
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���V�o#�F�͈�c D���7k��ũ5�0��;� ��a���<���� r��؝O���Ӊ:��� ���+�/�,�0̨̩�� � � / 5 S
Requête brute (extrait)
� ���V�o#�F�͈�c D���7k��ũ5�0��;� ��a���<���� r��؝O���Ӊ:��� ���+�/�,�0̨̩�� � � / 5 S � � � �e|M]V��P�-�I0N��b�8�Z� ��u^qkȪ��-ą:�=�Mۑ������F +�B�&�]x4� ����q�1 �&�� L�N�?���=
Meta JSON brut
{
"tls_ja3_hash": "f5b1b86cf354c66be6df405343980912",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1733,
"payload_entropy": 7.744386323730247,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5080,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0723de13f9d85b8a5322fd8868e532133ff26111",
"event_fingerprint": "e0713278c5720b552ef41aad0caeb6802da78c48",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f5b1b86cf354c66be6df405343980912",
"payload_hash": "c366269a5f6a60abc8cb396a1409849d",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 5080,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffd\u0018c\u001cD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\u001b\ufffda\ufffd\ufffd\u0003\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\u0016\ufffd\u061d\u001bO\ufffd\ufffd\ufffd\u04c9:\ufffd\u0004\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffd\u0018c\u001cD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\u001b\ufffda\ufffd\ufffd\u0003\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\u0016\ufffd\u061d\u001bO\ufffd\ufffd\ufffd\u04c9:\ufffd\u0004\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffde|M\u0014\u0012]V\ufffd\ufffdP\ufffd-\ufffdI0\u001aN\ue4a6\ufffd\u001a\ufffdb\ufffd8\ufffdZ\u0011\ufffd\u0019\u0000\ufffd\ufffdu^qk\u022a\ufffd\ufffd-\u0105:\ufffd=\ufffdM\u06d1\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\u001f+\ufffd\u0010B\ufffd\u0011&\ufffd]x4\ufffd\u0006\t\ufffd\ufffd\u03a2\ufffd\ufffd\u0015q\ufffd1\n\ufffd&\ufffd\ufffd\u0005\fL\ufffdN\ufffd\u0007?\ufffd\ufffd\ufffd=",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffd\u0018c\u001cD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\u001b\ufffda\ufffd\ufffd\u0003\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\u0016\ufffd\u061d\u001bO\ufffd\ufffd\ufffd\u04c9:\ufffd\u0004\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7da99b75b145816df0f1caaf06350f2c45c4e4dc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffd\u0018c\u001cD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\u001b\ufffda\ufffd\ufffd\u0003\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\u0016\ufffd\u061d\u001bO\ufffd\ufffd\ufffd\u04c9:\ufffd\u0004\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004",
"tls_ja3": "f5b1b86cf354c66be6df405343980912",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffdcD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\ufffda\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\ufffd\u061dO\ufffd\ufffd\ufffd\u04c9:\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S",
"attack_vector": "kafka probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5080,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffd\u0018c\u001cD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\u001b\ufffda\ufffd\ufffd\u0003\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\u0016\ufffd\u061d\u001bO\ufffd\ufffd\ufffd\u04c9:\ufffd\u0004\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006S\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004",
"tls_ja3": "f5b1b86cf354c66be6df405343980912",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "kafka probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdV\ufffdo#\ufffdF\ufffd\u0348\ufffdcD\ufffd\ufffd\ufffd7k\ufffd\ufffd\u01695\ufffd0\ufffd\ufffd;\ufffd \ufffd\ufffda\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd r\ufffd\ufffd\u061dO\ufffd\ufffd\ufffd\u04c9:\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5S",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5080 · TLS
|
tls
|
Sonde Kafka
kafka probe · via TLS:5080 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8243ef91fe477d24
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5080
Chemin / cible
—
Service
TLS
Payload
� �.q1 w IH���#I���X�p"?�� �b Hh�=�h1xң�Sε��H ��p'�+���8 ���+�/�,�0̨̩�� � � / 5 3ZZ #
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �.q1 w IH���#I���X�p"?�� �b Hh�=�h1xң�Sε��H ��p'�+���8 ���+�/�,�0̨̩�� � � / 5 3ZZ #
Requête brute (extrait)
� �.q1 w IH���#I���X�p"?�� �b Hh�=�h1xң�Sε��H ��p'�+���8 ���+�/�,�0̨̩�� � � / 5 3ZZ # h2http/1.1 3�횚 c��{�/���2jZ��_�n��{�:S�� ��?�s~6 \K�Fڀ�:�A�}�!��2/s�}z*�G<�|��K�O%��K2� �j zLNj<�x�Vb2T
Meta JSON brut
{
"tls_ja3_hash": "8243ef91fe477d24ac7d6935f6602625",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1701,
"payload_entropy": 7.709223640202549,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5080,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0723de13f9d85b8a5322fd8868e532133ff26111",
"event_fingerprint": "d6a489f6575ce68ea8077c133e564539dd6ab707",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8243ef91fe477d24ac7d6935f6602625",
"payload_hash": "d0546eb9873d6b04d534ade183561b92",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 5080,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003.q1\u0002\u001d\u001bw\fIH\ufffd\ufffd\u0002\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffd\u0006h1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\b\t\ufffd\u0015\ufffdp'\ufffd+\u0003\ufffd\ufffd\ufffd8\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063ZZ\u0000\u0000\u0000#\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0010",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003.q1\u0002\u001d\u001bw\fIH\ufffd\ufffd\u0002\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffd\u0006h1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\b\t\ufffd\u0015\ufffdp'\ufffd+\u0003\ufffd\ufffd\ufffd8\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063ZZ\u0000\u0000\u0000#\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u00003\u0004\ufffd\u0004\ud69a\u0000\u0001\u0000c\ufffd\u0004\ufffd{\u0010\ufffd\/\ufffd\u0006\ufffd\ufffd2jZ\ufffd\u000f\ufffd_\ufffdn\ufffd\ufffd{\ufffd\u0014:S\u0011\ufffd\ufffd\u001c\ufffd\ufffd?\ufffds~6\t\\K\ufffdF\u0680\ufffd\u001b:\ufffdA\ufffd}\ufffd!\ufffd\ufffd2\u0015\/s\ufffd}z*\ufffdG<\ufffd|\ufffd\ufffdK\ufffdO%\ufffd\ufffdK\u000e2\ufffd\u001c\ufffdj\u001czL\u0010Nj<\u0010\ufffdx\ufffdVb2T",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003.q1\u0002\u001d\u001bw\fIH\ufffd\ufffd\u0002\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffd\u0006h1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\b\t\ufffd\u0015\ufffdp'\ufffd+\u0003\ufffd\ufffd\ufffd8\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063ZZ\u0000\u0000\u0000#\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0010",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6afe7ba00ecc679480e9cbd3fc184d61a7d6b582",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003.q1\u0002\u001d\u001bw\fIH\ufffd\ufffd\u0002\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffd\u0006h1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\b\t\ufffd\u0015\ufffdp'\ufffd+\u0003\ufffd\ufffd\ufffd8\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063ZZ\u0000\u0000\u0000#\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0010",
"tls_ja3": "8243ef91fe477d24ac7d6935f6602625",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd.q1wIH\ufffd\ufffd\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffdh1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\t\ufffd\ufffdp'\ufffd+\ufffd\ufffd\ufffd8 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53ZZ#",
"attack_vector": "kafka probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5080,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003.q1\u0002\u001d\u001bw\fIH\ufffd\ufffd\u0002\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffd\u0006h1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\b\t\ufffd\u0015\ufffdp'\ufffd+\u0003\ufffd\ufffd\ufffd8\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063ZZ\u0000\u0000\u0000#\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0010",
"tls_ja3": "8243ef91fe477d24ac7d6935f6602625",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "kafka probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd.q1wIH\ufffd\ufffd\ufffd#I\ufffd\ufffd\ue426\ufffdX\ufffdp\"?\ufffd\ufffd \ufffdb Hh\ufffd=\ufffdh1x\u04a3\ufffdS\u03b5\ufffd\ufffdH\t\ufffd\ufffdp'\ufffd+\ufffd\ufffd\ufffd8 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53ZZ#",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5080 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5080 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a1bd12af17c2d06a
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5080
Chemin / cible
—
Service
TLS
Payload
� �Aʫ��h����D�5r�� ũ��0G���O�Xbk ���� �=� &�Y�Cc���xH�oWL0��� JJ�+�/�,�0̨̩�� � � / 5 3�� JJc�
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Kafka ApiVersions key
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Aʫ��h����D�5r�� ũ��0G���O�Xbk ���� �=� &�Y�Cc���xH�oWL0��� JJ�+�/�,�0̨̩�� � � / 5 3��
JJc�
Requête brute (extrait)
� �Aʫ��h����D�5r�� ũ��0G���O�Xbk ���� �=� &�Y�Cc���xH�oWL0��� JJ�+�/�,�0̨̩�� � � / 5 3�� JJc� 3��JJ c�� JU>��'_5#�`7Ϳ����'� ��0T��^bv�mD�*�������h��J3�<,U���kK���z�H��W�Z�
Meta JSON brut
{
"tls_ja3_hash": "a1bd12af17c2d06ab4311ce1a2e698f1",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1701,
"payload_entropy": 7.73899497716447,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0723de13f9d85b8a5322fd8868e532133ff26111",
"event_fingerprint": "65a2fb4ac46431992206fdea41ae641fe5616dc9",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0556",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Kafka ApiVersions key",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0556",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a1bd12af17c2d06ab4311ce1a2e698f1",
"payload_hash": "494735bc09d9d74cfbce76b9eefb2f2a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5080,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003A\u02ab\ufffd\ufffd\u0005h\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0000\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\u0007\ufffd\ufffd\u001d\ufffd=\ufffd\u0000&\ufffd\u000eY\ufffdCc\ufffd\ufffd\ufffdxH\ufffd\u0001oWL0\ufffd\ufffd\u0015\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\nJJc\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003A\u02ab\ufffd\ufffd\u0005h\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0000\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\u0007\ufffd\ufffd\u001d\ufffd=\ufffd\u0000&\ufffd\u000eY\ufffdCc\ufffd\ufffd\ufffdxH\ufffd\u0001oWL0\ufffd\ufffd\u0015\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\nJJc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u00003\u0004\ufffd\u0004\ufffdJJ\u0000\u0001\u0000c\ufffd\u0004\ufffd\fJU>\ufffd\ufffd'_\u00175#\ufffd`7\b\u037f\ufffd\ufffd\ufffd\ufffd'\ufffd \ufffd\ufffd\u00140T\ufffd\ufffd^bv\ufffdmD\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\u0005\ufffd\ufffdJ\u00193\ufffd\u0017<,U\ufffd\ufffd\u0004\ufffdkK\ufffd\ufffd\ufffdz\ufffdH\ufffd\ufffdW\ufffdZ\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003A\u02ab\ufffd\ufffd\u0005h\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0000\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\u0007\ufffd\ufffd\u001d\ufffd=\ufffd\u0000&\ufffd\u000eY\ufffdCc\ufffd\ufffd\ufffdxH\ufffd\u0001oWL0\ufffd\ufffd\u0015\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\nJJc\ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12ca6bcfe4a2956239686a3a5c9a1494286da587",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003A\u02ab\ufffd\ufffd\u0005h\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0000\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\u0007\ufffd\ufffd\u001d\ufffd=\ufffd\u0000&\ufffd\u000eY\ufffdCc\ufffd\ufffd\ufffdxH\ufffd\u0001oWL0\ufffd\ufffd\u0015\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\nJJc\ufffd",
"tls_ja3": "a1bd12af17c2d06ab4311ce1a2e698f1",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdA\u02ab\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd&\ufffdY\ufffdCc\ufffd\ufffd\ufffdxH\ufffdoWL0\ufffd\ufffd\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffd\n\nJJc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5080,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003A\u02ab\ufffd\ufffd\u0005h\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0000\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\u0007\ufffd\ufffd\u001d\ufffd=\ufffd\u0000&\ufffd\u000eY\ufffdCc\ufffd\ufffd\ufffdxH\ufffd\u0001oWL0\ufffd\ufffd\u0015\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\nJJc\ufffd",
"tls_ja3": "a1bd12af17c2d06ab4311ce1a2e698f1",
"port": 5080,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdA\u02ab\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffdD\ufffd5r\ufffd\ufffd\u0169\ufffd\ufffd0G\ufffd\ufffd\ufffdO\ufffdXbk \ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd&\ufffdY\ufffdCc\ufffd\ufffd\ufffdxH\ufffdoWL0\ufffd\ufffd\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffd\n\nJJc\ufffd",
"target_port_label": "5080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5078 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:5078 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5078
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 53
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5078
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Reque
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5078 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6376d7608bf08bdbc1e74c51b264e56bdd20ad52",
"http_host_hash": "14a606dedf0cb5ef1219b5c72afe8b883be7b806",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 456,
"payload_entropy": 5.47699947005189,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 5078,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 53,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "142e7eb13d11f40b8dfb5e4822245e70bd5cde94",
"event_fingerprint": "c705923ac98774867dc66fc5d2d68634347e30f6",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b17f14f4076f751bfda0c766a7303e14",
"payload_hash": "d6991eda16a3d99cbced942a31430929",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5078,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0abd4112d39231ed2a741ff16fcb1f43d78e7db",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"attack_vector": "exploit attempt \u00b7 via HTTP:5078 \u00b7 (tentative d'exploit)",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5078,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 5078,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:5078 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5078\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"target_port_label": "5078 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5078"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5092 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5092 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 38ab7c405819654d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5092
Chemin / cible
—
Service
TLS
Payload
� ���)��vMN��"Y 9ś̩;-�� ͉� ��2����&��!5�D^��B1����_ 9� ���+�/�,�0̨̩�� � � / 5 sZZ � �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���)��vMN��"Y 9ś̩;-�� ͉� ��2����&��!5�D^��B1����_
9� ���+�/�,�0̨̩�� � � / 5 sZZ �
�
Requête brute (extrait)
� ���)��vMN��"Y 9ś̩;-�� ͉� ��2����&��!5�D^��B1����_ 9� ���+�/�,�0̨̩�� � � / 5 sZZ � � ��D:�g�@��N_"�ފ9��x�}[��k% �R3�$�x��%7,�wp%O3 ����ÑI��{��7�Z�Ú�"�,ތ��^�%r�EE.��\�gA�>;Y���פƫ�"s��: ڿ
Meta JSON brut
{
"tls_ja3_hash": "38ab7c405819654d184dd0b4311990b3",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1765,
"payload_entropy": 7.750450729481246,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5092,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c47f2c04d4d43bb7fad36372e946af6f63eaef38",
"event_fingerprint": "488028331d4fd214f376455979069ec5acd06204",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "38ab7c405819654d184dd0b4311990b3",
"payload_hash": "18e1d454661cc5aba1d3a3bdcf098c8d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5092,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004",
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004\u0000 \ufffd\ufffdD:\ufffdg\b\ufffd@\u0015\ufffd\u001a\ufffdN_\"\ufffd\u0004\u078a9\ufffd\ufffdx\ufffd}[\ufffd\ufffdk%\u0000\ufffdR\b3\ufffd$\u1ad0\ufffdx\ufffd\u0002\ufffd%7,\ufffdwp%\u0013O3\u0000\ufffd\ufffd\u0012\ufffd\u000f\ufffd\u00d1I\ufffd\ufffd{\ufffd\ufffd7\ufffdZ\ufffd\u00da\ufffd\"\ufffd,\u078c\ufffd\ufffd^\ufffd%\u0005r\ufffdEE.\ufffd\ufffd\\\ufffdgA\ufffd>;Y\ufffd\ufffd\ufffd\u05e4\u01ab\ufffd\"s\ufffd\u0002\u0012\ufffd: \u06bf",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004\u0000 \ufffd\ufffdD:\ufffdg\b\ufffd@\u0015\ufffd\u001a\ufffdN_\"\ufffd\u0004\u078a9\ufffd\ufffdx\ufffd}[\ufffd\ufffdk%\u0000\ufffdR\b3\ufffd$\u1ad0\ufffdx\ufffd\u0002\ufffd%7,\ufffdwp%\u0013O3\u0000\ufffd\ufffd\u0012\ufffd\u000f\ufffd\u00d1I\ufffd\ufffd{\ufffd\ufffd7\ufffdZ\ufffd\u00da\ufffd\"\ufffd,\u078c\ufffd\ufffd^\ufffd%\u0005r\ufffdEE.\ufffd\ufffd\\\ufffdgA\ufffd>;Y\ufffd\ufffd\ufffd\u05e4\u01ab\ufffd\"s\ufffd\u0002\u0012\ufffd: \u06bf",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1923e87bd6b2ee43ccf1114186eef52b4610bfc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004",
"tls_ja3": "38ab7c405819654d184dd0b4311990b3",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffdvMN\ufffd\ufffd\"Y9\u015b\u0329;-\ufffd\ufffd\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\ufffd\ufffdB1\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5sZZ\ufffd\r\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:5092 \u00b7 (sonde \/ probe)",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5092,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\b)\ufffd\ufffdvMN\ufffd\ufffd\"\u0006Y\u0014\u000b9\b\u015b\u0329;-\ufffd\ufffd\u001d\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\u0016\u0010\u0006\ufffd\ufffdB1\u0014\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0004",
"tls_ja3": "38ab7c405819654d184dd0b4311990b3",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffdvMN\ufffd\ufffd\"Y9\u015b\u0329;-\ufffd\ufffd\u0349\ufffd \ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd!5\ufffdD^\ufffd\ufffdB1\ufffd\ufffd\ufffd\ufffd_\n\t9\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5sZZ\ufffd\r\ufffd",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5090
|
—
|
Sonde port
Sonde port · port 5090 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5090
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 5090,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1db6ce50e34de95326e75c7e9ac1b21633cb50b2",
"event_fingerprint": "f43be4c5f10f0a41f34ca1bea1e9150e0048ff89",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5090,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c5ff3ffd8690cb4331b6bcd2e1a573f193808a6",
"protocol_details": {
"port": 5090
},
"attack_vector": "Sonde port \u00b7 port 5090 \u00b7 (sonde \/ probe)",
"target_port_label": "5090",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5090,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5090
},
"attack_vector": "Sonde port \u00b7 port 5090 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5090",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 54
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7001
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Reque
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7001 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6376d7608bf08bdbc1e74c51b264e56bdd20ad52",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 456,
"payload_entropy": 5.4702537644020595,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d73dced9c6611387505bd9126e8c2645dbb9d588",
"event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b17f14f4076f751bfda0c766a7303e14",
"payload_hash": "e2eef3e69bd3feb67d9847589f97367e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edge\/12.246",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efdd81be57cd4370f0ecd35a4d55ffb97e4c1b34",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.6422.60 Safari\/537.36 Edg\u2026",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nConnection: keep-alive\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade-Insecure-Reque",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5064
|
—
|
Sonde port
Sonde port · port 5064 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5064
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 5064,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "38cf1ec6f6fe41ea258d292408d0d43e34be5bb6",
"event_fingerprint": "39f19f38d60f71149148369852e727602a74e5d0",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5064,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2811bc43dff2fcb6bddf09d76a029ac5fee6f4b",
"protocol_details": {
"port": 5064
},
"attack_vector": "Sonde port \u00b7 port 5064 \u00b7 (sonde \/ probe)",
"target_port_label": "5064",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5064,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5064
},
"attack_vector": "Sonde port \u00b7 port 5064 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5064",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5064"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
5069 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5069 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8ac6fafe20c2f800
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5069
Chemin / cible
—
Service
TLS
Payload
� ��ޫ�Ay�m����1�6%W36̔<�(�M�u�D �(r���w7Re�m_��1����=4� � �+�/�,�0̨̩�� � � / 5 sJJ Di h2
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ޫ�Ay�m����1�6%W36̔<�(�M�u�D �(r���w7Re�m_��1����=4� �
�+�/�,�0̨̩�� � � / 5 sJJ Di h2
Requête brute (extrait)
� ��ޫ�Ay�m����1�6%W36̔<�(�M�u�D �(r���w7Re�m_��1����=4� � �+�/�,�0̨̩�� � � / 5 sJJ Di h2 + �� � � (�B��W� גJ�����*��LJe� �{�* �|��(l���G����09E�k�'�b�~��z{�����P�� ����x^�`{�3��
Meta JSON brut
{
"tls_ja3_hash": "8ac6fafe20c2f800ba813ba60af2186e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1765,
"payload_entropy": 7.736843990778774,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5069,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b120e6ec3a3ccf152c018c0c2baae2dd8c90f482",
"event_fingerprint": "079e66b40ecd480143957440a692dc768ab6ca12",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8ac6fafe20c2f800ba813ba60af2186e",
"payload_hash": "4649deeb892df50c0a5cf493543064b4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5069,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD\u0014 \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\u0015\ufffd\ufffd\u0018\ufffd\u0018\u0006=4\ufffd\u001c\u001b\ufffd\u001e\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD\u0014 \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\u0015\ufffd\ufffd\u0018\ufffd\u0018\u0006=4\ufffd\u001c\u001b\ufffd\u001e\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0012\u0000 (\ufffdB\u0017\u0010\ufffd\ufffdW\ufffd\f\u05d2J\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffdL\u000fJ\u0006e\ufffd\t\ufffd{\ufffd*\u0000\ufffd|\ufffd\ufffd(l\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd\u0016\ufffd09E\ufffdk\ufffd'\ufffdb\u0006\u0013\ufffd~\ufffd\ufffdz{\ufffd\ufffd\ufffd\u0010\ufffd\ufffdP\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd\u001ax^\ufffd\u001a`{\ufffd3\ufffd\ufffd\u001f",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD\u0014 \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\u0015\ufffd\ufffd\u0018\ufffd\u0018\u0006=4\ufffd\u001c\u001b\ufffd\u001e\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d97ec05b90de6d6d427cb13d8f5400cbe569cf1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD\u0014 \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\u0015\ufffd\ufffd\u0018\ufffd\u0018\u0006=4\ufffd\u001c\u001b\ufffd\u001e\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"tls_ja3": "8ac6fafe20c2f800ba813ba60af2186e",
"port": 5069,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd=4\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5sJJDih2",
"attack_vector": "tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
"target_port_label": "5069 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5069,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD\u0014 \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\u0015\ufffd\ufffd\u0018\ufffd\u0018\u0006=4\ufffd\u001c\u001b\ufffd\u001e\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006sJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000",
"tls_ja3": "8ac6fafe20c2f800ba813ba60af2186e",
"port": 5069,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u07ab\ufffdAy\ufffdm\ufffd\ufffd\ufffd\ufffd1\ufffd6%W36\u0314<\ufffd(\ufffdM\ufffdu\ufffdD \ufffd(r\ufffd\ufffd\ufffdw7Re\ufffdm_\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd=4\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5sJJDih2",
"target_port_label": "5069 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5069"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5081 · TLS
|
tls
|
Sonde Kafka
kafka probe · via TLS:5081 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c20e83854558aea9
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5081
Chemin / cible
—
Service
TLS
Payload
���!�L�WR{N�S ,�I�8�e� ���� 0�֎֔5"�D�F� ��V�q� ԝ��Y��jWf ���+�/�,�0̨̩�� � � / 5 ��� -
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���!�L�WR{N�S
,�I�8�e� ���� 0�֎֔5"�D�F� ��V�q� ԝ��Y��jWf ���+�/�,�0̨̩�� � � / 5 ��� -
Requête brute (extrait)
���!�L�WR{N�S ,�I�8�e� ���� 0�֎֔5"�D�F� ��V�q� ԝ��Y��jWf ���+�/�,�0̨̩�� � � / 5 ��� - � � ���W ������ ��+x@ڋ�?S�w!��!? �J�eHP�%�("�����-�4.�6c�{�}���w _� 4ϲ�!a,�l�{���B���օ
Meta JSON brut
{
"tls_ja3_hash": "c20e83854558aea91de7c162676be016",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1797,
"payload_entropy": 7.74263338290226,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5081,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "20e7c9891938ecc742976665720f48e9cacce874",
"event_fingerprint": "dddcdaf794336d29213524da936d33392023b590",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c20e83854558aea91de7c162676be016",
"payload_hash": "e58dab650abcf0d23fb2f0ed0de6c7aa",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 5081,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0019\ufffd!\ufffdL\ufffdWR{N\ufffd\u0002S\r,\ufffdI\ufffd8\ufffd\u001a\u0016e\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\u0015 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\u0000\ufffd\ufffdV\ufffdq\ufffd\u001d\u051d\u0003\ufffd\ufffdY\ufffd\ufffdjWf\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0019\ufffd!\ufffdL\ufffdWR{N\ufffd\u0002S\r,\ufffdI\ufffd8\ufffd\u001a\u0016e\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\u0015 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\u0000\ufffd\ufffdV\ufffdq\ufffd\u001d\u051d\u0003\ufffd\ufffdY\ufffd\ufffdjWf\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffd\ufffdW\u001d\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\u0017\ufffd\f\ufffd\ufffd+x@\u001a\u068b\ufffd?S\ufffdw!\ufffd\ufffd!?\u0000\ufffdJ\ufffdeHP\ufffd%\ufffd(\"\ufffd\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001a-\ufffd4.\ufffd6c\ufffd{\ufffd}\u001b\u0015\u009e\ufffd\ufffd\ufffdw _\ufffd\u001f4\u03f2\ufffd!a,\ufffdl\b\ufffd{\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\u001b\u0585",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0019\ufffd!\ufffdL\ufffdWR{N\ufffd\u0002S\r,\ufffdI\ufffd8\ufffd\u001a\u0016e\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\u0015 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\u0000\ufffd\ufffdV\ufffdq\ufffd\u001d\u051d\u0003\ufffd\ufffdY\ufffd\ufffdjWf\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b2912cff236a3edbe65ce56fe7712c5cfe52baa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0019\ufffd!\ufffdL\ufffdWR{N\ufffd\u0002S\r,\ufffdI\ufffd8\ufffd\u001a\u0016e\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\u0015 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\u0000\ufffd\ufffdV\ufffdq\ufffd\u001d\u051d\u0003\ufffd\ufffdY\ufffd\ufffdjWf\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
"tls_ja3": "c20e83854558aea91de7c162676be016",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd!\ufffdL\ufffdWR{N\ufffdS\r,\ufffdI\ufffd8\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\ufffd\ufffdV\ufffdq\ufffd\u051d\ufffd\ufffdY\ufffd\ufffdjWf \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-",
"attack_vector": "kafka probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5081,
"protocol_emulated": null,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0019\ufffd!\ufffdL\ufffdWR{N\ufffd\u0002S\r,\ufffdI\ufffd8\ufffd\u001a\u0016e\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\u0015 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\u0000\ufffd\ufffdV\ufffdq\ufffd\u001d\u051d\u0003\ufffd\ufffdY\ufffd\ufffdjWf\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
"tls_ja3": "c20e83854558aea91de7c162676be016",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "kafka probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd!\ufffdL\ufffdWR{N\ufffdS\r,\ufffdI\ufffd8\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd 0\ufffd\u058e\u05945\"\ufffdD\ufffdF\ufffd\ufffd\ufffdV\ufffdq\ufffd\u051d\ufffd\ufffdY\ufffd\ufffdjWf \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5093 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5093 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 cd3471107797c779
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5093
Chemin / cible
—
Service
TLS
Payload
� ��^��� /0 ��� v�Ic}�?��)��\&�5�� ���)pQ��� �[����^���w4�מ �)� JJ�+�/�,�0̨̩�� � � / 5 3�� + ZZ
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0607
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��^��� /0 ��� v�Ic}�?��)��\&�5�� ���)pQ��� �[����^���w4�מ
�)� JJ�+�/�,�0̨̩�� � � / 5 3�� + ZZ
Requête brute (extrait)
� ��^��� /0 ��� v�Ic}�?��)��\&�5�� ���)pQ��� �[����^���w4�מ �)� JJ�+�/�,�0̨̩�� � � / 5 3�� + ZZ ��c� h2http/1.1� Di h2 - # � � " �VI1
Meta JSON brut
{
"tls_ja3_hash": "cd3471107797c779e2e56d977809ce7f",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1701,
"payload_entropy": 7.770009478712443,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5093,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e2423bfc46e9cf7597280bf5cc2ed5849f76f925",
"event_fingerprint": "8a3a01d6ee2f33e6e176356f71705d5d19124a01",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0607"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "cd3471107797c779e2e56d977809ce7f",
"payload_hash": "b3de36e92d368f3cfb76e6d84c562aed",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5093,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd^\ufffd\ufffd\ufffd\u001e\/0\u000b\ufffd\ufffd\u0014\ufffd\u000bv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\u0014\ufffd)pQ\ufffd\ufffd\u0014\ufffd\u001c\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0016\ufffdw4\ufffd\u05de\r\ufffd)\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd^\ufffd\ufffd\ufffd\u001e\/0\u000b\ufffd\ufffd\u0014\ufffd\u000bv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\u0014\ufffd)pQ\ufffd\ufffd\u0014\ufffd\u001c\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0016\ufffdw4\ufffd\u05de\r\ufffd)\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003\u0003\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\"\u0000 \u000f\ufffdVI1",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd^\ufffd\ufffd\ufffd\u001e\/0\u000b\ufffd\ufffd\u0014\ufffd\u000bv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\u0014\ufffd)pQ\ufffd\ufffd\u0014\ufffd\u001c\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0016\ufffdw4\ufffd\u05de\r\ufffd)\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d604786b947a232e675978e92e95f05e9248adc5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd^\ufffd\ufffd\ufffd\u001e\/0\u000b\ufffd\ufffd\u0014\ufffd\u000bv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\u0014\ufffd)pQ\ufffd\ufffd\u0014\ufffd\u001c\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0016\ufffdw4\ufffd\u05de\r\ufffd)\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003",
"tls_ja3": "cd3471107797c779e2e56d977809ce7f",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\/0\ufffd\ufffd\ufffdv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\ufffd)pQ\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffdw4\ufffd\u05de\r\ufffd)\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffd+ZZ",
"attack_vector": "tls probe \u00b7 via TLS:5093 \u00b7 (sonde \/ probe)",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5093,
"protocol_emulated": null,
"tags_summary": [
"pat-0607"
],
"tags_summary_labels_fr": [
"pat-0607"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd^\ufffd\ufffd\ufffd\u001e\/0\u000b\ufffd\ufffd\u0014\ufffd\u000bv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\u0014\ufffd)pQ\ufffd\ufffd\u0014\ufffd\u001c\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0016\ufffdw4\ufffd\u05de\r\ufffd)\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\ufffd\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003",
"tls_ja3": "cd3471107797c779e2e56d977809ce7f",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\/0\ufffd\ufffd\ufffdv\ufffdIc}\ufffd?\ufffd\ufffd)\ufffd\ufffd\\&\ufffd5\ufffd\ufffd \ufffd\ufffd\ufffd)pQ\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffdw4\ufffd\u05de\r\ufffd)\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53\ufffd\ufffd+ZZ",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:5093",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5093
|
—
|
Sonde port
Sonde port · port 5093 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5093
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": null,
"app_proto": null,
"asn": 396982,
"country": "US",
"dst_port": 5093,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1bbd7acf1bbbc8b779dc61786182fa026bbef483",
"event_fingerprint": "a7c2aeba5c2161a393b6f81d935f0190c532b954",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5093,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82adc64d22eee6fcc15e7d1dd317e7d6f6831a87",
"protocol_details": {
"port": 5093
},
"attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
"target_port_label": "5093",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5093,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5093
},
"attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5093",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
5116 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:5116 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d262945e03cad8c8
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5116
Chemin / cible
—
Service
TLS
Payload
� �~�b�����sW��gI:/˟Mp2��Ӧ ��x����t-�c�`������=E8&^���e��| JJ�+�/�,�0̨̩�� � � / 5 3
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0607
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �~�b�����sW��gI:/˟Mp2��Ӧ ��x����t-�c�`������=E8&^���e��| JJ�+�/�,�0̨̩�� � � / 5 3
Requête brute (extrait)
� �~�b�����sW��gI:/˟Mp2��Ӧ ��x����t-�c�`������=E8&^���e��| JJ�+�/�,�0̨̩�� � � / 5 3 ::c� h2http/1.1 � � � �����"�}h� ��r+������n�� �_ �h���1eān���g�
Meta JSON brut
{
"tls_ja3_hash": "d262945e03cad8c8bb185bb5600eba87",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 1701,
"payload_entropy": 7.727591582362208,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "US",
"dst_port": 5116,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f3bb33a61fe55d23ab72c5f2ac21cb1ab71bbfc0",
"event_fingerprint": "1055d24116826c9eebdeac8601bdb60bf2a8b61d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0607"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d262945e03cad8c8bb185bb5600eba87",
"payload_hash": "89d15dfd8fc3db79b68e9bdeea586327",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 5116,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0017~\ufffdb\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u0018sW\ufffd\u000f\ufffdg\u0016I:\u0012\/\u02dfMp\u00112\ufffd\ufffd\u04e6 \f\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\n\n\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0017~\ufffdb\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u0018sW\ufffd\u000f\ufffdg\u0016I:\u0012\/\u02dfMp\u00112\ufffd\ufffd\u04e6 \f\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\n\n\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000\f\u0000\n::c\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \u0016\u0012\ufffd\ufffd\ufffd\u000e\ufffd\ufffd\"\ufffd}h\ufffd\u0017 \ufffd\ufffdr+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd \ufffd_\u0000\ufffdh\u0017\ufffd\ufffd\ufffd1e\u0101n\ufffd\u0002\ufffd\ufffdg\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0017~\ufffdb\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u0018sW\ufffd\u000f\ufffdg\u0016I:\u0012\/\u02dfMp\u00112\ufffd\ufffd\u04e6 \f\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\n\n\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bb518a2b94fa7c90703eb3cdf26b053a7f98281",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0017~\ufffdb\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u0018sW\ufffd\u000f\ufffdg\u0016I:\u0012\/\u02dfMp\u00112\ufffd\ufffd\u04e6 \f\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\n\n\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"tls_ja3": "d262945e03cad8c8bb185bb5600eba87",
"port": 5116,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd~\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffdsW\ufffd\ufffdgI:\/\u02dfMp2\ufffd\ufffd\u04e6 \ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd| JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53",
"attack_vector": "tls probe \u00b7 via TLS:5116 \u00b7 (sonde \/ probe)",
"target_port_label": "5116 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5116,
"protocol_emulated": null,
"tags_summary": [
"pat-0607"
],
"tags_summary_labels_fr": [
"pat-0607"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0017~\ufffdb\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u0018sW\ufffd\u000f\ufffdg\u0016I:\u0012\/\u02dfMp\u00112\ufffd\ufffd\u04e6 \f\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\n\n\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000",
"tls_ja3": "d262945e03cad8c8bb185bb5600eba87",
"port": 5116,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5116 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd~\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffdsW\ufffd\ufffdgI:\/\u02dfMp2\ufffd\ufffd\u04e6 \ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdt-\ufffdc\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=E8&^\ufffd\ufffd\ufffde\ufffd\ufffd| JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53",
"target_port_label": "5116 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5116"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|