|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� �kS�Ĕ��>i�r��bQ`��� =�\' �� �'��>`{j�f(% Wf�����Qmݗ� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� �kS�Ĕ��>i�r��bQ`��� =�\' �� �'��>`{j�f(% Wf�����Qmݗ� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �kS�Ĕ��>i�r��bQ`��� =�\' �� �'��>`{j�f(% Wf�����Qmݗ� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��+�.�V.� �ݾ��R�ʬ� ���'�5' �F
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.74588452204444,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4fdc028cf6499c0a4e076970c0b97d83",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003kS\ufffdE\u0306\ufffd\ufffd>\u0001i\ufffdr\ufffd\ufffdbQ`\ufffd\u000f\ufffd\ufffd\u0019\u001e=\ufffd\\'\u001d\ufffd\ufffd\u0012 \ufffd\u0011'\u000f\ufffd\ufffd>`{j\ufffdf\u0001(%\fW\u0007f\ufffd\u0013\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003kS\ufffdE\u0306\ufffd\ufffd>\u0001i\ufffdr\ufffd\ufffdbQ`\ufffd\u000f\ufffd\ufffd\u0019\u001e=\ufffd\\'\u001d\ufffd\ufffd\u0012 \ufffd\u0011'\u000f\ufffd\ufffd>`{j\ufffdf\u0001(%\fW\u0007f\ufffd\u0013\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd+\ufffd.\ufffdV.\ufffd\n\ufffd\u077e\ufffd\ufffdR\ufffd\u02ac\ufffd \ufffd\ufffd\ufffd\u000f'\ufffd5'\u001c\ufffdF",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003kS\ufffdE\u0306\ufffd\ufffd>\u0001i\ufffdr\ufffd\ufffdbQ`\ufffd\u000f\ufffd\ufffd\u0019\u001e=\ufffd\\'\u001d\ufffd\ufffd\u0012 \ufffd\u0011'\u000f\ufffd\ufffd>`{j\ufffdf\u0001(%\fW\u0007f\ufffd\u0013\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fe4cf02977f83e0f2dff3a801089cb78be3158d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003kS\ufffdE\u0306\ufffd\ufffd>\u0001i\ufffdr\ufffd\ufffdbQ`\ufffd\u000f\ufffd\ufffd\u0019\u001e=\ufffd\\'\u001d\ufffd\ufffd\u0012 \ufffd\u0011'\u000f\ufffd\ufffd>`{j\ufffdf\u0001(%\fW\u0007f\ufffd\u0013\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffdkS\ufffdE\u0306\ufffd\ufffd>i\ufffdr\ufffd\ufffdbQ`\ufffd\ufffd\ufffd=\ufffd\\'\ufffd\ufffd \ufffd'\ufffd\ufffd>`{j\ufffdf(%Wf\ufffd\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003kS\ufffdE\u0306\ufffd\ufffd>\u0001i\ufffdr\ufffd\ufffdbQ`\ufffd\u000f\ufffd\ufffd\u0019\u001e=\ufffd\\'\u001d\ufffd\ufffd\u0012 \ufffd\u0011'\u000f\ufffd\ufffd>`{j\ufffdf\u0001(%\fW\u0007f\ufffd\u0013\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdkS\ufffdE\u0306\ufffd\ufffd>i\ufffdr\ufffd\ufffdbQ`\ufffd\ufffd\ufffd=\ufffd\\'\ufffd\ufffd \ufffd'\ufffd\ufffd>`{j\ufffdf(%Wf\ufffd\ufffd\ufffd\ufffd\ufffdQm\u0757\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� �%n@4��l o!���pJ�W1�T,�"��<_.Ġ* ��� �e�T�kn�n$jY�*�<���wft@�/ &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� �%n@4��l o!���pJ�W1�T,�"��<_.Ġ* ��� �e�T�kn�n$jY�*�<���wft@�/ &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �%n@4��l o!���pJ�W1�T,�"��<_.Ġ* ��� �e�T�kn�n$jY�*�<���wft@�/ &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ "Ȣ529�iQ�R��~ �<���H��c`�*�� &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.885120097103092,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "85e666a30df68fa394738a6d6d622026",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%n@4\ufffd\ufffdl\fo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120\u0001* \u0005\u001c\ufffd\ufffd\ufffd\f\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\u0011\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%n@4\ufffd\ufffdl\fo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120\u0001* \u0005\u001c\ufffd\ufffd\ufffd\f\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\u0011\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \"\u0222529\ufffdiQ\ufffdR\ufffd\ufffd~\u001c\ufffd<\ufffd\ufffd\ufffdH\u0001\ufffd\ufffdc`\ufffd*\ufffd\ufffd\u001e&",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%n@4\ufffd\ufffdl\fo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120\u0001* \u0005\u001c\ufffd\ufffd\ufffd\f\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\u0011\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7704e080a646729803492a71ec8a408d83e7447f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%n@4\ufffd\ufffdl\fo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120\u0001* \u0005\u001c\ufffd\ufffd\ufffd\f\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\u0011\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd%n@4\ufffd\ufffdlo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120* \ufffd\ufffd\ufffd\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%n@4\ufffd\ufffdl\fo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120\u0001* \u0005\u001c\ufffd\ufffd\ufffd\f\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\u0011\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd%n@4\ufffd\ufffdlo!\ufffd\ufffd\ufffdpJ\ufffdW1\ufffdT,\ufffd\"\ufffd\ufffd<_.\u0120* \ufffd\ufffd\ufffd\ufffde\ufffdT\ufffdkn\ufffdn$jY\ufffd*\ufffd<\ufffd\ufffd\ufffdwft@\ufffd\/&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� ��K��(�:c�k{�n���X*ۤ�ki���� <(����ɶ(�*]��ta���3bTe��"S�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��K��(�:c�k{�n���X*ۤ�ki���� <(����ɶ(�*]��ta���3bTe��"S�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��K��(�:c�k{�n���X*ۤ�ki���� <(����ɶ(�*]��ta���3bTe��"S�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ K��s,%=�rMk�Oi>b ��'�\R:��2]
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.868111324528012,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "758bceb9be887abbd3da1c306a95e4f6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd(\u0018\ufffd\u001b:c\ufffdk{\ufffdn\ufffd\u0010\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\u000e\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd(\u0018\ufffd\u001b:c\ufffdk{\ufffdn\ufffd\u0010\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\u000e\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 K\ufffd\ufffds,%=\ufffdrMk\u0019\ufffdOi>b\u0006\u000b\ufffd\ufffd'\ufffd\\R:\ufffd\ufffd2\u000f]",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd(\u0018\ufffd\u001b:c\ufffdk{\ufffdn\ufffd\u0010\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\u000e\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77f793f532daf0f730767db3d035bed261cd1228",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd(\u0018\ufffd\u001b:c\ufffdk{\ufffdn\ufffd\u0010\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\u000e\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd(\ufffd:c\ufffdk{\ufffdn\ufffd\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd(\u0018\ufffd\u001b:c\ufffdk{\ufffdn\ufffd\u0010\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\u000e\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd(\ufffd:c\ufffdk{\ufffdn\ufffd\ufffd\ufffdX*\u06e4\ufffdki\ufffd\ufffd\ufffd\ufffd <(\ufffd\ufffd\ufffd\ufffd\u0276(\ufffd*]\ufffd\ufffdta\ufffd\ufffd\ufffd3bTe\ufffd\ufffd\"S\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� �&_W��a������ �PMKy-����MVɃ� �1����zY����֊�]���L�<����{�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&_W��a������ �PMKy-����MVɃ� �1����zY����֊�]���L�<����{�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �&_W��a������ �PMKy-����MVɃ� �1����zY����֊�]���L�<����{�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �6����F��Bud��*+M ���h�{]Tb��@
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.894674151078627,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "659fc64a45efbbf769c1cf650ff82f39",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0019_W\u0017\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdPMK\u0010y-\ufffd\ufffd\ufffd\u0005\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\u0011\ufffd\ufffdL\ufffd<\ufffd\ufffd\u0010\ufffd\ufffd{\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0019_W\u0017\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdPMK\u0010y-\ufffd\ufffd\ufffd\u0005\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\u0011\ufffd\ufffdL\ufffd<\ufffd\ufffd\u0010\ufffd\ufffd{\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd6\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffdBud\ufffd\ufffd*+M\t\u0012\ufffd\ufffd\ufffdh\ufffd{]T\u001ab\ufffd\ufffd@",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0019_W\u0017\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdPMK\u0010y-\ufffd\ufffd\ufffd\u0005\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\u0011\ufffd\ufffdL\ufffd<\ufffd\ufffd\u0010\ufffd\ufffd{\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6eef5f695ea9f45bdc3fdc86ecc474453a2328a2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0019_W\u0017\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdPMK\u0010y-\ufffd\ufffd\ufffd\u0005\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\u0011\ufffd\ufffdL\ufffd<\ufffd\ufffd\u0010\ufffd\ufffd{\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd&_W\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdPMKy-\ufffd\ufffd\ufffd\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\ufffd\ufffdL\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0019_W\u0017\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffdPMK\u0010y-\ufffd\ufffd\ufffd\u0005\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\u0011\ufffd\ufffdL\ufffd<\ufffd\ufffd\u0010\ufffd\ufffd{\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd&_W\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdPMKy-\ufffd\ufffd\ufffd\ufffdMV\u0243\ufffd \ufffd1\ufffd\ufffd\ufffd\ufffdzY\ufffd\ufffd\ufffd\ufffd\u058a\ufffd]\ufffd\ufffd\ufffdL\ufffd<\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� �걵���~��l�MV+,��m��6��q��� �hj��V�KX�����>�������i�U�! &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� �걵���~��l�MV+,��m��6��q��� �hj��V�KX�����>�������i�U�! &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �걵���~��l�MV+,��m��6��q��� �hj��V�KX�����>�������i�U�! &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �8����ԛ�p� 2�hh �$� 3�lez,f
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.790593600343476,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7da24740ed8381817cf53585b260782",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\u0019\ufffdM\u0014V+\u0016\u0005,\ufffd\ufffdm\ufffd\ufffd\u00046\ufffd\ufffdq\ufffd\ufffd\ufffd \u0001 \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\u0019\ufffdM\u0014V+\u0016\u0005,\ufffd\ufffdm\ufffd\ufffd\u00046\ufffd\ufffdq\ufffd\ufffd\ufffd \u0001 \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u00118\ufffd\ufffd\ufffd\ufffd\u051b\u0013\ufffdp\ufffd\t2\ufffdhh\f\ufffd$\ufffd\f3\ufffd\u0015lez,f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\u0019\ufffdM\u0014V+\u0016\u0005,\ufffd\ufffdm\ufffd\ufffd\u00046\ufffd\ufffdq\ufffd\ufffd\ufffd \u0001 \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ed2a644e34f39eef837afe4cbece69b2e5c4cce",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\u0019\ufffdM\u0014V+\u0016\u0005,\ufffd\ufffdm\ufffd\ufffd\u00046\ufffd\ufffdq\ufffd\ufffd\ufffd \u0001 \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\ufffdMV+,\ufffd\ufffdm\ufffd\ufffd6\ufffd\ufffdq\ufffd\ufffd\ufffd \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\u0019\ufffdM\u0014V+\u0016\u0005,\ufffd\ufffdm\ufffd\ufffd\u00046\ufffd\ufffdq\ufffd\ufffd\ufffd \u0001 \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\uac75\ufffd\ufffd\ufffd~\ufffd\ufffdl\ufffdMV+,\ufffd\ufffdm\ufffd\ufffd6\ufffd\ufffdq\ufffd\ufffd\ufffd \ufffdhj\ufffd\ufffdV\ufffdKX\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdU\ufffd!&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� �ٚ�V>Ċ�jLaַVrow6S�֡�?�6J6 �c-V��8 3�М"5B����6���ٹpr�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ٚ�V>Ċ�jLaַVrow6S�֡�?�6J6 �c-V��8
3�М"5B����6���ٹpr�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �ٚ�V>Ċ�jLaַVrow6S�֡�?�6J6 �c-V��8 3�М"5B����6���ٹpr�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �EX8U�0`Z� _�Hzi�u���Е���g`
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.792827120156883,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fad790944383f0d40dd4a67d81209807",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow\b6S\u0014\ufffd\u05a1\ufffd?\ufffd6J6\u001a \ufffdc-V\ufffd\ufffd8\n\u000e3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679p\u0005r\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow\b6S\u0014\ufffd\u05a1\ufffd?\ufffd6J6\u001a \ufffdc-V\ufffd\ufffd8\n\u000e3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679p\u0005r\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdEX8U\ufffd0`Z\ufffd\u001d_\ufffdHzi\ufffdu\ufffd\ufffd\ufffd\u0415\u001a\ufffd\ufffd\ufffdg`\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow\b6S\u0014\ufffd\u05a1\ufffd?\ufffd6J6\u001a \ufffdc-V\ufffd\ufffd8\n\u000e3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679p\u0005r\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75de85100bf00f7260f69200e34baae2707be1cc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow\b6S\u0014\ufffd\u05a1\ufffd?\ufffd6J6\u001a \ufffdc-V\ufffd\ufffd8\n\u000e3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679p\u0005r\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow6S\ufffd\u05a1\ufffd?\ufffd6J6 \ufffdc-V\ufffd\ufffd8\n3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679pr\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow\b6S\u0014\ufffd\u05a1\ufffd?\ufffd6J6\u001a \ufffdc-V\ufffd\ufffd8\n\u000e3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679p\u0005r\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u065a\ufffdV>\u010a\ufffdjLa\u05b7Vrow6S\ufffd\u05a1\ufffd?\ufffd6J6 \ufffdc-V\ufffd\ufffd8\n3\ufffd\u041c\"5B\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\u0679pr\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� ��[sPH��~ r� Q���� �ב�� j���n w �C���!�M�¬�5+D�E���G��I��$�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��[sPH��~ r� Q���� �ב�� j���n w �C���!�M�¬�5+D�E���G��I��$�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��[sPH��~ r� Q���� �ב�� j���n w �C���!�M�¬�5+D�E���G��I��$�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ D�͔��&̨lɽPté�[Nk�� �FMf�q
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.851617690595557,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e69385ae7eea3d5ee7f692b2fffefd80",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[sPH\ufffd\ufffd\u0014~\b\fr\ufffd\u001cQ\u0015\ufffd\ufffd\ufffd\ufffd\f\ufffd\u05d1\ufffd\ufffd\fj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\u000e\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[sPH\ufffd\ufffd\u0014~\b\fr\ufffd\u001cQ\u0015\ufffd\ufffd\ufffd\ufffd\f\ufffd\u05d1\ufffd\ufffd\fj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\u000e\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 D\u0004\ufffd\u0354\ufffd\ufffd&\u0328l\u027dPt\u00e9\ufffd[Nk\ufffd\u0005\ufffd\f\ufffdFMf\ufffdq\u0007",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[sPH\ufffd\ufffd\u0014~\b\fr\ufffd\u001cQ\u0015\ufffd\ufffd\ufffd\ufffd\f\ufffd\u05d1\ufffd\ufffd\fj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\u000e\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69029bc740e58c7609ab9fe80ae3c7594661a84c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[sPH\ufffd\ufffd\u0014~\b\fr\ufffd\u001cQ\u0015\ufffd\ufffd\ufffd\ufffd\f\ufffd\u05d1\ufffd\ufffd\fj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\u000e\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd[sPH\ufffd\ufffd~r\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\u05d1\ufffd\ufffdj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd[sPH\ufffd\ufffd\u0014~\b\fr\ufffd\u001cQ\u0015\ufffd\ufffd\ufffd\ufffd\f\ufffd\u05d1\ufffd\ufffd\fj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\u000e\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd[sPH\ufffd\ufffd~r\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\u05d1\ufffd\ufffdj\ufffd\ufffd\ufffdn w \ufffdC\ufffd\ufffd\ufffd!\ufffdM\ufffd\u00ac\ufffd5+D\ufffdE\ufffd\ufffd\ufffdG\ufffd\ufffdI\ufffd\ufffd$\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� ��F�D+ 7 ���$� ��{� K�d�,?��A ��/ wn����?�Q-ǥ(Ӥ5>��t &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��F�D+ 7 ���$� ��{� K�d�,?��A ��/ wn����?�Q-ǥ(Ӥ5>��t &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��F�D+ 7 ���$� ��{� K�d�,?��A ��/ wn����?�Q-ǥ(Ӥ5>��t &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ Fzs�"6LO�����n���5~:c�"VO�8�ii
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.825410145423642,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c360479cb324a014030acdfc1457bd1a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdF\ufffdD\u0019+\u001f7\u000b\u0006\ufffd\ufffd\ufffd$\ufffd\u001d\ufffd\u0016\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\u001b\ufffd\u0011\ufffd?\ufffd\u001a\u0001Q-\u000f\u0012\u01e5(\u04e45>\u0016\ufffd\u0002\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdF\ufffdD\u0019+\u001f7\u000b\u0006\ufffd\ufffd\ufffd$\ufffd\u001d\ufffd\u0016\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\u001b\ufffd\u0011\ufffd?\ufffd\u001a\u0001Q-\u000f\u0012\u01e5(\u04e45>\u0016\ufffd\u0002\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Fzs\ufffd\"6LO\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\u00165~:c\ufffd\"VO\ufffd8\ufffdi\u0011i",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdF\ufffdD\u0019+\u001f7\u000b\u0006\ufffd\ufffd\ufffd$\ufffd\u001d\ufffd\u0016\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\u001b\ufffd\u0011\ufffd?\ufffd\u001a\u0001Q-\u000f\u0012\u01e5(\u04e45>\u0016\ufffd\u0002\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a7d37d953c25cb1b6db5540fa0a5cb0ec213fc2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdF\ufffdD\u0019+\u001f7\u000b\u0006\ufffd\ufffd\ufffd$\ufffd\u001d\ufffd\u0016\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\u001b\ufffd\u0011\ufffd?\ufffd\u001a\u0001Q-\u000f\u0012\u01e5(\u04e45>\u0016\ufffd\u0002\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdF\ufffdD+7\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\ufffd\ufffd?\ufffdQ-\u01e5(\u04e45>\ufffd\ufffdt&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdF\ufffdD\u0019+\u001f7\u000b\u0006\ufffd\ufffd\ufffd$\ufffd\u001d\ufffd\u0016\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\u001b\ufffd\u0011\ufffd?\ufffd\u001a\u0001Q-\u000f\u0012\u01e5(\u04e45>\u0016\ufffd\u0002\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdF\ufffdD+7\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd{\ufffd K\ufffdd\ufffd,?\ufffd\ufffdA \ufffd\ufffd\/\twn\ufffd\ufffd\ufffd\ufffd?\ufffdQ-\u01e5(\u04e45>\ufffd\ufffdt&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� ��Â�2ʼnp��i�~]�yg�8WN%�<�vDJ�YU ���L�pe'� �~�ZL��,M��Ӹ����/Y &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Â�2ʼnp��i�~]�yg�8WN%�<�vDJ�YU ���L�pe'�
�~�ZL��,M��Ӹ����/Y &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��Â�2ʼnp��i�~]�yg�8WN%�<�vDJ�YU ���L�pe'� �~�ZL��,M��Ӹ����/Y &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �vw������MR(���S�¨$< �^ߏmF|G"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.857667492471956,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "78205964f7c5968399c84cec3f3a6776",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u00c2\ufffd2\u0019\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\u0019\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u0001\u04f8\ufffd\u0004\ufffd\ufffd\ufffd\/Y\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u00c2\ufffd2\u0019\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\u0019\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u0001\u04f8\ufffd\u0004\ufffd\ufffd\ufffd\/Y\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdvw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\u0012R(\ufffd\ufffd\ufffdS\ufffd\u00a8$<\u000b\ufffd^\u07cfmF|G\"",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u00c2\ufffd2\u0019\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\u0019\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u0001\u04f8\ufffd\u0004\ufffd\ufffd\ufffd\/Y\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "791c06569c58be2af20091d106f629f17a3b3734",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u00c2\ufffd2\u0019\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\u0019\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u0001\u04f8\ufffd\u0004\ufffd\ufffd\ufffd\/Y\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u00c2\ufffd2\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u04f8\ufffd\ufffd\ufffd\ufffd\/Y&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u00c2\ufffd2\u0019\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\u0019\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u0001\u04f8\ufffd\u0004\ufffd\ufffd\ufffd\/Y\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u00c2\ufffd2\u0149p\ufffd\ufffdi\ufffd~]\ufffdyg\ufffd8WN%\ufffd<\ufffdvDJ\ufffdYU \ufffd\ufffd\ufffdL\ufffdpe'\ufffd\r\ufffd~\ufffdZL\ufffd\ufffd,M\ufffd\ufffd\u04f8\ufffd\ufffd\ufffd\ufffd\/Y&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Sonde PostgreSQL
postgres probe · via HTTPS:9443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
� ����k�N�E�����* ��� �ه�O�� � ��3�?��{B�_)���~D��z� 0Y�% &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����k�N�E�����* ��� �ه�O�� � ��3�?��{B�_)���~D��z� 0Y�% &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ����k�N�E�����* ��� �ه�O�� � ��3�?��{B�_)���~D��z� 0Y�% &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ [�i������f�����n*/ک D��!B
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 239,
"payload_entropy": 5.766875101703375,
"port_category": "registered",
"org": "Google LLC",
"service": "https",
"app_proto": "https",
"asn": 396982,
"country": "IN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f2969b3a7d1c31616fffb40602d4e6e3999b3dc2",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d9fb2897796b45327ccfa9429fbf7c3e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdk\ufffdN\ufffd\u0014E\ufffd\u0012\u001b\ufffd\ufffd\ufffd\ufffd*\u001e\ufffd\ufffd\ufffd\f\ufffd\u0647\u0005\ufffdO\ufffd\ufffd \ufffd\u001d\ufffd\ufffd3\ufffd?\ufffd\u0013\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\u0012\ufffd\ufffd\u0015z\ufffd\t0Y\ufffd%\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdk\ufffdN\ufffd\u0014E\ufffd\u0012\u001b\ufffd\ufffd\ufffd\ufffd*\u001e\ufffd\ufffd\ufffd\f\ufffd\u0647\u0005\ufffdO\ufffd\ufffd \ufffd\u001d\ufffd\ufffd3\ufffd?\ufffd\u0013\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\u0012\ufffd\ufffd\u0015z\ufffd\t0Y\ufffd%\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b[\ufffd\u001b\u0013i\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffdf\ufffd\u0018\ufffd\ufffd\ufffd\ufffdn*\/\u06a9\tD\ufffd\ufffd\u0017!B",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdk\ufffdN\ufffd\u0014E\ufffd\u0012\u001b\ufffd\ufffd\ufffd\ufffd*\u001e\ufffd\ufffd\ufffd\f\ufffd\u0647\u0005\ufffdO\ufffd\ufffd \ufffd\u001d\ufffd\ufffd3\ufffd?\ufffd\u0013\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\u0012\ufffd\ufffd\u0015z\ufffd\t0Y\ufffd%\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92ab1f27ab8676fe5a8f55587155139ac733d835",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdk\ufffdN\ufffd\u0014E\ufffd\u0012\u001b\ufffd\ufffd\ufffd\ufffd*\u001e\ufffd\ufffd\ufffd\f\ufffd\u0647\u0005\ufffdO\ufffd\ufffd \ufffd\u001d\ufffd\ufffd3\ufffd?\ufffd\u0013\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\u0012\ufffd\ufffd\u0015z\ufffd\t0Y\ufffd%\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffdN\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\u0647\ufffdO\ufffd\ufffd \ufffd\ufffd\ufffd3\ufffd?\ufffd\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\ufffd\ufffdz\ufffd\t0Y\ufffd%&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdk\ufffdN\ufffd\u0014E\ufffd\u0012\u001b\ufffd\ufffd\ufffd\ufffd*\u001e\ufffd\ufffd\ufffd\f\ufffd\u0647\u0005\ufffdO\ufffd\ufffd \ufffd\u001d\ufffd\ufffd3\ufffd?\ufffd\u0013\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\u0012\ufffd\ufffd\u0015z\ufffd\t0Y\ufffd%\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "postgres probe \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffdN\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\u0647\ufffdO\ufffd\ufffd \ufffd\ufffd\ufffd3\ufffd?\ufffd\ufffd{B\ufffd_)\ufffd\ufffd\ufffd~D\ufffd\ufffdz\ufffd\t0Y\ufffd%&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|