|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /src/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /src/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 102,
"payload_entropy": 4.920302862828531,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "154e2523531ca766d610d43912159fa5",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87e6990eae9c8b34cd55a91eb5e2695ace5ab084",
"protocol_details": {
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 98,
"payload_entropy": 4.9406132028853245,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d1377adaabba17bf63450fcd19747729",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b01a684eebdf32095c409c9ae4edf803571c07de",
"protocol_details": {
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /app/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 102,
"payload_entropy": 4.947311563830134,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa311d287a27c8e3d5d4679d7ca2277d",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a46bd87ea28529103e82bcf72a9c61a86cd32c4",
"protocol_details": {
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /htdocs/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /htdocs/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 105,
"payload_entropy": 4.945949219428352,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4a0beefb77c5b1af5e8fd972add0fbd1",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ee4afbd9ca3706d20559a36db39d4c2d52c08d0",
"protocol_details": {
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /var/www/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /var/www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 106,
"payload_entropy": 4.961424588070536,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "efb8d64d7f7d6d3b553a9b617dfef379",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad0cadd4ec25661ca7e3f8821f7e0abecc5d9f9d",
"protocol_details": {
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /backend/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /backend/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 106,
"payload_entropy": 4.978190451027857,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "399aa491c003ccd710805813028280dd",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "747d22be9c4dcc3dd102fc44e90102f0c6353f83",
"protocol_details": {
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /api/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 102,
"payload_entropy": 4.947311563830134,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "000f35102008fd9a21675e0a3b7ad0ac",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16be38f5f9a1b5b75d655a6c1fbaac6cc12f9503",
"protocol_details": {
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /site/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /site/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 103,
"payload_entropy": 4.924642465292485,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bde80c56c0379d3ecfce04a074630063",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c22f348a7552274797e9fc154d0b0ae33766936d",
"protocol_details": {
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /www/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 102,
"payload_entropy": 4.947311563830134,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c4b93a2f94f691689d549dbcc96ff8ef",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b4b97454e80de6a115be34092f3c04a52562bd6",
"protocol_details": {
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /html/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /html/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 103,
"payload_entropy": 5.001342800534136,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "35ba9cca7bcffc31e8cc100925a38cee",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2aaa22b631434d65ed6f57b0422a5996f2dd81a5",
"protocol_details": {
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /public/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /public/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 105,
"payload_entropy": 5.008711985769141,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "59feed0d03960dffb5000fd7385856ba",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dfba457ddc0800829a1fa3541c960d058bbcfaf",
"protocol_details": {
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde port 4000/TCP
port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Preuve honeypot — Sonde port 4000/TCP
Connexion détectée sur le port 4000 (TCP) du capteur simulé.
Service
REMOTEANYTHING
Payload
GET /wordpress/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:4000
Pourquoi cette classification : Type « port_4000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /wordpress/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:4000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 108,
"payload_entropy": 4.940040748919158,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b358df70b1e83170e018b5e7e40916c74db31499",
"event_fingerprint": "123f3fa281f5d8a1453f8a8cc3c3d1e6733064ef",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "remoteanything",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c260cfa53dbd9cee63acfae2cb5be649",
"path_pattern_hash": "ebbad2afaa1aa2962e0cd0a39c748f59"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 41
},
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"evidence": {
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6e2a0210646bc75812febfaa22297a22ba71f6b",
"protocol_details": {
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "port 4000 tcp \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:4000",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 adb4141728e9c1f2
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� ��W����oA�.U���k���_��>C�M� �n���;F�L�Uȕ�|�������z�` �,�+̩�0�/̨ � � -
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��W����oA�.U���k���_��>C�M� �n���;F�L�Uȕ�|�������z�` �,�+̩�0�/̨ � � -
Requête brute (extrait)
� ��W����oA�.U���k���_��>C�M� �n���;F�L�Uȕ�|�������z�` �,�+̩�0�/̨ � � - http/1.1 + # 3 & $ Rׅ��$�[f�JC���X��e��:x}<
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.897589750280189,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4520ed0a1cd32d6d92c8f9ea84197a90",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "adb4141728e9c1f28dc823f296a44693",
"ja4": "593eb09b8d0305ba69a2397d59c5e098",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "adb4141728e9c1f28dc823f296a44693",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-23-13-16-5-11-43-35-51-10,29-23-24,0",
"tls_ja4_hash": "593eb09b8d0305ba69a2397d59c5e098",
"tls_ja4": "t13d0110_129e5e89549e_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018W\ufffd\ufffd\ufffd\ufffdo\u0006A\ufffd\u0017\u0007.U\ufffd\ufffd\u0003\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>\u0017C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0003\b\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018W\ufffd\ufffd\ufffd\ufffdo\u0006A\ufffd\u0017\u0007.U\ufffd\ufffd\u0003\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>\u0017C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0003\b\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 R\u05c5\ufffd\ufffd\u0019$\ufffd\u0010\u0019[f\ufffdJC\ufffd\ufffd\ufffdX\u0017\ufffd\ufffde\ufffd\ufffd:x}<\u0015\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018W\ufffd\ufffd\ufffd\ufffdo\u0006A\ufffd\u0017\u0007.U\ufffd\ufffd\u0003\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>\u0017C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0003\b\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb621bc28f6febc8d254a8cc80f78286e94e9b2e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018W\ufffd\ufffd\ufffd\ufffdo\u0006A\ufffd\u0017\u0007.U\ufffd\ufffd\u0003\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>\u0017C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0003\b\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001",
"tls_ja3": "adb4141728e9c1f28dc823f296a44693",
"tls_ja4": "593eb09b8d0305ba69a2397d59c5e098",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdoA\ufffd.U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018W\ufffd\ufffd\ufffd\ufffdo\u0006A\ufffd\u0017\u0007.U\ufffd\ufffd\u0003\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>\u0017C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0003\b\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001",
"tls_ja3": "adb4141728e9c1f28dc823f296a44693",
"tls_ja4": "593eb09b8d0305ba69a2397d59c5e098",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdoA\ufffd.U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd_\ufffd\ufffd>C\ufffdM\ufffd \ufffdn\ufffd\ufffd\ufffd;F\ufffdL\ufffdU\u0215\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd`\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde PostgreSQL
postgres probe · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 213cf13ac0730dbb
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �䲻��~LhnM� X ��?� 2D(�G �� r��U; �G4 ���aX��ϙm� �dĉ34kc �,�+̩�0�/̨ � � -
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �䲻��~LhnM� X
��?�
2D(�G �� r��U;
�G4 ���aX��ϙm� �dĉ34kc �,�+̩�0�/̨ � � -
Requête brute (extrait)
� �䲻��~LhnM� X ��?� 2D(�G �� r��U; �G4 ���aX��ϙm� �dĉ34kc �,�+̩�0�/̨ � � - http/1.1 + 3 & $ +�(�B�V�r��!y 3�r^+���s �- #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.7736719974583215,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48a8b8cef358b49d7dd053a5fe7dad80",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "213cf13ac0730dbbd86e79be6b0c4dc4",
"ja4": "b33c053ddab9a29c98d5250dcb9ea3d9",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "213cf13ac0730dbbd86e79be6b0c4dc4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-5-45-13-23-16-43-51-35-10,29-23-24,0",
"tls_ja4_hash": "b33c053ddab9a29c98d5250dcb9ea3d9",
"tls_ja4": "t13d0110_9023b97d9bed_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u4cbb\ufffd\ufffd~LhnM\ufffd\u000b\u0007X\n\ufffd\ufffd?\u0018\ufffd\u0014\r\u00152D(\ufffdG\u000b\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\u0017\ufffd\ufffd\u0006\u03d9m\ufffd\u000b\ufffdd\u010934kc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u4cbb\ufffd\ufffd~LhnM\ufffd\u000b\u0007X\n\ufffd\ufffd?\u0018\ufffd\u0014\r\u00152D(\ufffdG\u000b\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\u0017\ufffd\ufffd\u0006\u03d9m\ufffd\u000b\ufffdd\u010934kc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 +\ufffd(\u0002\ufffdB\ufffdV\ufffdr\u000f\ufffd\ufffd!y\u001f3\ufffdr^+\u0002\ufffd\ufffd\ufffd\u001bs\u001f\ufffd-\u0018\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u4cbb\ufffd\ufffd~LhnM\ufffd\u000b\u0007X\n\ufffd\ufffd?\u0018\ufffd\u0014\r\u00152D(\ufffdG\u000b\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\u0017\ufffd\ufffd\u0006\u03d9m\ufffd\u000b\ufffdd\u010934kc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1da1250c0484468b8c75d10d5196686aacd67dd2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u4cbb\ufffd\ufffd~LhnM\ufffd\u000b\u0007X\n\ufffd\ufffd?\u0018\ufffd\u0014\r\u00152D(\ufffdG\u000b\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\u0017\ufffd\ufffd\u0006\u03d9m\ufffd\u000b\ufffdd\u010934kc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000",
"tls_ja3": "213cf13ac0730dbbd86e79be6b0c4dc4",
"tls_ja4": "b33c053ddab9a29c98d5250dcb9ea3d9",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\u4cbb\ufffd\ufffd~LhnM\ufffdX\n\ufffd\ufffd?\ufffd\r2D(\ufffdG\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\ufffd\ufffd\u03d9m\ufffd\ufffdd\u010934kc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u4cbb\ufffd\ufffd~LhnM\ufffd\u000b\u0007X\n\ufffd\ufffd?\u0018\ufffd\u0014\r\u00152D(\ufffdG\u000b\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\u0017\ufffd\ufffd\u0006\u03d9m\ufffd\u000b\ufffdd\u010934kc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000",
"tls_ja3": "213cf13ac0730dbbd86e79be6b0c4dc4",
"tls_ja4": "b33c053ddab9a29c98d5250dcb9ea3d9",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u4cbb\ufffd\ufffd~LhnM\ufffdX\n\ufffd\ufffd?\ufffd\r2D(\ufffdG\ufffd\ufffd r\ufffd\ufffdU;\n\ufffdG4 \ufffd\ufffd\ufffdaX\ufffd\ufffd\u03d9m\ufffd\ufffdd\u010934kc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde PostgreSQL
postgres probe · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 6b8da31c795d98d6
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �N���-�G�����+��́��oKhmU�.O�� �TRe[$��&�Q nW�M�h�Z ����ٟ� �,�+̩�0�/̨ � � # - 3 & $
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N���-�G�����+��́��oKhmU�.O�� �TRe[$��&�Q nW�M�h�Z ����ٟ� �,�+̩�0�/̨ � � # - 3 & $
Requête brute (extrait)
� �N���-�G�����+��́��oKhmU�.O�� �TRe[$��&�Q nW�M�h�Z ����ٟ� �,�+̩�0�/̨ � � # - 3 & $ ���`ݻ���ql�����m^�*���@i�X + http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.8966000178128475,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f18804d3bdcdcad867b0197594fc2fbc",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "6b8da31c795d98d6f9052b8ad140a71c",
"ja4": "7103639aa36eaaa87734f5b37d8d2b41",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "6b8da31c795d98d6f9052b8ad140a71c",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-35-45-51-5-10-43-13-23-16,29-23-24,0",
"tls_ja4_hash": "7103639aa36eaaa87734f5b37d8d2b41",
"tls_ja4": "t13d0110_8aaa49aba1cd_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd\u0014-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0007\u0301\ufffd\ufffdoKhmU\u0019\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\u0006\ufffd&\ufffdQ\u001cnW\ufffdM\ufffdh\ufffdZ\u000b\ufffd\ufffd\u0006\ufffd\ufffd\u065f\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd\u0014-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0007\u0301\ufffd\ufffdoKhmU\u0019\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\u0006\ufffd&\ufffdQ\u001cnW\ufffdM\ufffdh\ufffdZ\u000b\ufffd\ufffd\u0006\ufffd\ufffd\u065f\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd`\u077b\u0010\ufffd\ufffd\ufffd\u001bql\ufffd\ufffd\ufffd\ufffd\u0013\ufffdm^\ufffd*\u0007\ufffd\ufffd\ufffd@i\ufffdX\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd\u0014-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0007\u0301\ufffd\ufffdoKhmU\u0019\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\u0006\ufffd&\ufffdQ\u001cnW\ufffdM\ufffdh\ufffdZ\u000b\ufffd\ufffd\u0006\ufffd\ufffd\u065f\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5292d3943a301686ad7a3320f500e636670f7244",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd\u0014-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0007\u0301\ufffd\ufffdoKhmU\u0019\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\u0006\ufffd&\ufffdQ\u001cnW\ufffdM\ufffdh\ufffdZ\u000b\ufffd\ufffd\u0006\ufffd\ufffd\u065f\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000",
"tls_ja3": "6b8da31c795d98d6f9052b8ad140a71c",
"tls_ja4": "7103639aa36eaaa87734f5b37d8d2b41",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0301\ufffd\ufffdoKhmU\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\ufffd&\ufffdQnW\ufffdM\ufffdh\ufffdZ\ufffd\ufffd\ufffd\ufffd\u065f\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-3&$",
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd\ufffd\ufffd\u0014-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0007\u0301\ufffd\ufffdoKhmU\u0019\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\u0006\ufffd&\ufffdQ\u001cnW\ufffdM\ufffdh\ufffdZ\u000b\ufffd\ufffd\u0006\ufffd\ufffd\u065f\u0004\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000",
"tls_ja3": "6b8da31c795d98d6f9052b8ad140a71c",
"tls_ja4": "7103639aa36eaaa87734f5b37d8d2b41",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd-\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\u0301\ufffd\ufffdoKhmU\ufffd.O\ufffd\ufffd \ufffdTRe[$\ufffd\ufffd&\ufffdQnW\ufffdM\ufffdh\ufffdZ\ufffd\ufffd\ufffd\ufffd\u065f\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-3&$",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b4cd925a9253856c
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� ��t9�mC�` :��+Hk��Ɏ��B��do6�� ���b��W���*r��"�&��~����Jqf �,�+̩�0�/̨ � � +
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��t9�mC�` :��+Hk��Ɏ��B��do6�� ���b��W���*r��"�&��~����Jqf �,�+̩�0�/̨ � �
+
Requête brute (extrait)
� ��t9�mC�` :��+Hk��Ɏ��B��do6�� ���b��W���*r��"�&��~����Jqf �,�+̩�0�/̨ � � + # - 3 & $ �u`(�˅♴ߢ��V~�&t�� �Ǻ�;^ http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.904427891069663,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a013159ca6c36154483aeb92f87932bb",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "b4cd925a9253856cae73a032224046ac",
"ja4": "44179b0df5754273ed4dc8310e9c9fb1",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "b4cd925a9253856cae73a032224046ac",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-11-43-35-5-45-13-51-16-23,29-23-24,0",
"tls_ja4_hash": "44179b0df5754273ed4dc8310e9c9fb1",
"tls_ja4": "t13d0110_b6f5e3dd54c2_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdt9\ufffd\u0012mC\ufffd`\u001f:\ufffd\ufffd+Hk\ufffd\u0018\ufffd\u024e\u0019\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\u0013\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\u0005\ufffd\"\ufffd&\ufffd\u0016\ufffd~\ufffd\u0001\ufffd\ufffd\ufffdJqf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdt9\ufffd\u0012mC\ufffd`\u001f:\ufffd\ufffd+Hk\ufffd\u0018\ufffd\u024e\u0019\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\u0013\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\u0005\ufffd\"\ufffd&\ufffd\u0016\ufffd~\ufffd\u0001\ufffd\ufffd\ufffdJqf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdu`(\ufffd\u02c5\u2674\u07e2\ufffd\ufffd\u0010V~\ufffd&t\ufffd\u000f\ufffd\u0000\ufffd\b\u01fa\ufffd;^\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdt9\ufffd\u0012mC\ufffd`\u001f:\ufffd\ufffd+Hk\ufffd\u0018\ufffd\u024e\u0019\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\u0013\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\u0005\ufffd\"\ufffd&\ufffd\u0016\ufffd~\ufffd\u0001\ufffd\ufffd\ufffdJqf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1fdbcdb97ecc816d2fe5b174fa36e98d0d052a53",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdt9\ufffd\u0012mC\ufffd`\u001f:\ufffd\ufffd+Hk\ufffd\u0018\ufffd\u024e\u0019\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\u0013\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\u0005\ufffd\"\ufffd&\ufffd\u0016\ufffd~\ufffd\u0001\ufffd\ufffd\ufffdJqf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003",
"tls_ja3": "b4cd925a9253856cae73a032224046ac",
"tls_ja4": "44179b0df5754273ed4dc8310e9c9fb1",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffdt9\ufffdmC\ufffd`:\ufffd\ufffd+Hk\ufffd\ufffd\u024e\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\ufffd\"\ufffd&\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdJqf\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdt9\ufffd\u0012mC\ufffd`\u001f:\ufffd\ufffd+Hk\ufffd\u0018\ufffd\u024e\u0019\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\u0013\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\u0005\ufffd\"\ufffd&\ufffd\u0016\ufffd~\ufffd\u0001\ufffd\ufffd\ufffdJqf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003",
"tls_ja3": "b4cd925a9253856cae73a032224046ac",
"tls_ja4": "44179b0df5754273ed4dc8310e9c9fb1",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdt9\ufffdmC\ufffd`:\ufffd\ufffd+Hk\ufffd\ufffd\u024e\ufffd\ufffdB\ufffd\ufffddo6\ufffd\ufffd \ufffd\ufffd\ufffdb\ufffd\ufffdW\ufffd\ufffd\ufffd*r\ufffd\ufffd\"\ufffd&\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffdJqf\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde PostgreSQL
postgres probe · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 51439fd29c39939e
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �5!r)�� � 4���7H%��5ו�� �Y� ��y, �g�c Gl2ڗ_�@@�t�8���(3� �,�+̩�0�/̨ � � http/1.1
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5!r)�� � 4���7H%��5ו�� �Y� ��y, �g�c Gl2ڗ_�@@�t�8���(3� �,�+̩�0�/̨ � � http/1.1
Requête brute (extrait)
� �5!r)�� � 4���7H%��5ו�� �Y� ��y, �g�c Gl2ڗ_�@@�t�8���(3� �,�+̩�0�/̨ � � http/1.1 # + - 3 & $ ���\:����W�8.��c �o��*S�Pq� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.8789680505305295,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d6006769a0101ca1326b5796f6ed6ab5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "51439fd29c39939e8305e854655adabd",
"ja4": "71a1088f4785f51da793115a76398d8f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "51439fd29c39939e8305e854655adabd",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-16-23-35-5-10-43-45-51-13,29-23-24,0",
"tls_ja4_hash": "71a1088f4785f51da793115a76398d8f",
"tls_ja4": "t13d0110_00c265b1cb7e_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035\u0015!\u001br)\ufffd\ufffd\u001e\ufffd\u000b4\ufffd\ufffd\ufffd7H%\u0003\ufffd\ufffd5\u05d5\ufffd\u0001\ufffd \ufffdY\ufffd \ufffd\ufffdy,\u001f\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\u0003\ufffd8\ufffd\ufffd\u0012\ufffd(3\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035\u0015!\u001br)\ufffd\ufffd\u001e\ufffd\u000b4\ufffd\ufffd\ufffd7H%\u0003\ufffd\ufffd5\u05d5\ufffd\u0001\ufffd \ufffdY\ufffd \ufffd\ufffdy,\u001f\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\u0003\ufffd8\ufffd\ufffd\u0012\ufffd(3\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\\:\ufffd\ufffd\ufffd\ufffdW\ufffd8.\ufffd\ufffdc\u0016\u001f\ufffdo\ufffd\ufffd*S\ufffd\u0010Pq\ufffd\n\ufffd\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035\u0015!\u001br)\ufffd\ufffd\u001e\ufffd\u000b4\ufffd\ufffd\ufffd7H%\u0003\ufffd\ufffd5\u05d5\ufffd\u0001\ufffd \ufffdY\ufffd \ufffd\ufffdy,\u001f\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\u0003\ufffd8\ufffd\ufffd\u0012\ufffd(3\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6d5214543b539f60cccf4ef0d7d596e43ed97f0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035\u0015!\u001br)\ufffd\ufffd\u001e\ufffd\u000b4\ufffd\ufffd\ufffd7H%\u0003\ufffd\ufffd5\u05d5\ufffd\u0001\ufffd \ufffdY\ufffd \ufffd\ufffdy,\u001f\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\u0003\ufffd8\ufffd\ufffd\u0012\ufffd(3\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "51439fd29c39939e8305e854655adabd",
"tls_ja4": "71a1088f4785f51da793115a76398d8f",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd5!r)\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd7H%\ufffd\ufffd5\u05d5\ufffd\ufffd \ufffdY\ufffd \ufffd\ufffdy,\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\ufffd8\ufffd\ufffd\ufffd(3\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035\u0015!\u001br)\ufffd\ufffd\u001e\ufffd\u000b4\ufffd\ufffd\ufffd7H%\u0003\ufffd\ufffd5\u05d5\ufffd\u0001\ufffd \ufffdY\ufffd \ufffd\ufffdy,\u001f\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\u0003\ufffd8\ufffd\ufffd\u0012\ufffd(3\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000",
"tls_ja3": "51439fd29c39939e8305e854655adabd",
"tls_ja4": "71a1088f4785f51da793115a76398d8f",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd5!r)\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd7H%\ufffd\ufffd5\u05d5\ufffd\ufffd \ufffdY\ufffd \ufffd\ufffdy,\ufffdg\ufffdc\tGl2\u0697_\ufffd@@\ufffdt\ufffd8\ufffd\ufffd\ufffd(3\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 23f3cef294fa3796
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� ���g������ ����4�C���xG���V~ ҘB��2�c�R+�g �ф�-;1��tI�� � �,�+̩�0�/̨ � � - #
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���g������ ����4�C���xG���V~ ҘB��2�c�R+�g �ф�-;1��tI�� � �,�+̩�0�/̨ � � - #
Requête brute (extrait)
� ���g������ ����4�C���xG���V~ ҘB��2�c�R+�g �ф�-;1��tI�� � �,�+̩�0�/̨ � � - # http/1.1 + 3 & $ dQӡ�F���홼O�\�76g�G��!>�I|( k
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.886072668342915,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2519ab43247fad149fa2f303630c808d",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "23f3cef294fa3796d7b968c747d3e3a3",
"ja4": "24538224be77772ffb96f8674b4a87f7",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "23f3cef294fa3796d7b968c747d3e3a3",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-45-35-11-16-43-51-13-10-5,29-23-24,0",
"tls_ja4_hash": "24538224be77772ffb96f8674b4a87f7",
"tls_ja4": "t13d0110_bd16d1df2c44_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdg\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\u0006\ufffd\ufffd\ufffd\u0018\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~\u0017 \u0498B\ufffd\ufffd\u0006\u00152\ufffdc\ufffdR+\ufffdg\u0014\u0000\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\u001c\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdg\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\u0006\ufffd\ufffd\ufffd\u0018\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~\u0017 \u0498B\ufffd\ufffd\u0006\u00152\ufffdc\ufffdR+\ufffdg\u0014\u0000\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\u001c\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 dQ\u0006\u04e1\ufffdF\ufffd\ufffd\ufffd\ud67cO\ufffd\\\ufffd76g\ufffdG\ufffd\ufffd!>\ufffdI|(\u001fk\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdg\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\u0006\ufffd\ufffd\ufffd\u0018\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~\u0017 \u0498B\ufffd\ufffd\u0006\u00152\ufffdc\ufffdR+\ufffdg\u0014\u0000\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\u001c\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0bd99ef9638ec026708d40c254b5d1ad49466bf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdg\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\u0006\ufffd\ufffd\ufffd\u0018\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~\u0017 \u0498B\ufffd\ufffd\u0006\u00152\ufffdc\ufffdR+\ufffdg\u0014\u0000\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\u001c\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000",
"tls_ja3": "23f3cef294fa3796d7b968c747d3e3a3",
"tls_ja4": "24538224be77772ffb96f8674b4a87f7",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~ \u0498B\ufffd\ufffd2\ufffdc\ufffdR+\ufffdg\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdg\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\u0006\ufffd\ufffd\ufffd\u0018\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~\u0017 \u0498B\ufffd\ufffd\u0006\u00152\ufffdc\ufffdR+\ufffdg\u0014\u0000\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\u001c\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000",
"tls_ja3": "23f3cef294fa3796d7b968c747d3e3a3",
"tls_ja4": "24538224be77772ffb96f8674b4a87f7",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdC\ufffd\ufffd\ufffdxG\ufffd\ufffd\ufffdV~ \u0498B\ufffd\ufffd2\ufffdc\ufffdR+\ufffdg\ufffd\u0444\ufffd-;1\ufffd\ufffdtI\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde PostgreSQL
postgres probe · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 99af72b401aeb4d5
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� ����&$,�� *G?;�R�� �8Z��H�3 ��ga �m�AKa�n�ܒ�)v�. �IF��n#�v �,�+̩�0�/̨ � � 3 & $ 9p�A�= �5�l:�?#O
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����&$,�� *G?;�R�� �8Z��H�3 ��ga
�m�AKa�n�ܒ�)v�. �IF��n#�v �,�+̩�0�/̨ � � 3 & $ 9p�A�= �5�l:�?#O
Requête brute (extrait)
� ����&$,�� *G?;�R�� �8Z��H�3 ��ga �m�AKa�n�ܒ�)v�. �IF��n#�v �,�+̩�0�/̨ � � 3 & $ 9p�A�= �5�l:�?#O����8��"����f - + http/1.1 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.864064524745028,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d90983537424f9605eefb6d0d454db2",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "99af72b401aeb4d5e63dc6d3f0dd2170",
"ja4": "8d83633614afabc03dc7b877f4ecb616",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "99af72b401aeb4d5e63dc6d3f0dd2170",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-13-23-45-5-11-43-16-35-10,29-23-24,0",
"tls_ja4_hash": "8d83633614afabc03dc7b877f4ecb616",
"tls_ja4": "t13d0110_903fa5a68775_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000f\ufffd\ufffd&$,\ufffd\u001b\ufffd\u001d*G?\u0012;\ufffdR\ufffd\ufffd\u000b\u000b\u0019\ufffd8Z\ufffd\ufffdH\u0010\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\u001c\ufffdIF\ufffd\ufffdn#\ufffdv\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000f\ufffd\ufffd&$,\ufffd\u001b\ufffd\u001d*G?\u0012;\ufffdR\ufffd\ufffd\u000b\u000b\u0019\ufffd8Z\ufffd\ufffdH\u0010\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\u001c\ufffdIF\ufffd\ufffdn#\ufffdv\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O\ufffd\ufffd\ufffd\b\ufffd8\ufffd\ufffd\"\ufffd\ufffd\ufffd\u0001\u0012\ufffdf\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000f\ufffd\ufffd&$,\ufffd\u001b\ufffd\u001d*G?\u0012;\ufffdR\ufffd\ufffd\u000b\u000b\u0019\ufffd8Z\ufffd\ufffdH\u0010\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\u001c\ufffdIF\ufffd\ufffdn#\ufffdv\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61aeb0d552ec33f12d183935402946c059df37d9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000f\ufffd\ufffd&$,\ufffd\u001b\ufffd\u001d*G?\u0012;\ufffdR\ufffd\ufffd\u000b\u000b\u0019\ufffd8Z\ufffd\ufffdH\u0010\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\u001c\ufffdIF\ufffd\ufffdn#\ufffdv\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"tls_ja3": "99af72b401aeb4d5e63dc6d3f0dd2170",
"tls_ja4": "8d83633614afabc03dc7b877f4ecb616",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd&$,\ufffd\ufffd*G?;\ufffdR\ufffd\ufffd\ufffd8Z\ufffd\ufffdH\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\ufffdIF\ufffd\ufffdn#\ufffdv\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000f\ufffd\ufffd&$,\ufffd\u001b\ufffd\u001d*G?\u0012;\ufffdR\ufffd\ufffd\u000b\u000b\u0019\ufffd8Z\ufffd\ufffdH\u0010\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\u001c\ufffdIF\ufffd\ufffdn#\ufffdv\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"tls_ja3": "99af72b401aeb4d5e63dc6d3f0dd2170",
"tls_ja4": "8d83633614afabc03dc7b877f4ecb616",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd&$,\ufffd\ufffd*G?;\ufffdR\ufffd\ufffd\ufffd8Z\ufffd\ufffdH\ufffd3 \ufffd\ufffdga\n\ufffdm\ufffdAKa\ufffdn\ufffd\u0712\ufffd)v\ufffd.\ufffdIF\ufffd\ufffdn#\ufffdv\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ 9p\ufffdA\ufffd=\t\ufffd5\ufffdl:\ufffd?#O",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
Sonde PostgreSQL
postgres probe · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7b7c21f1a4523674
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �� Ǖ��xW�:; ��f��y��/ �ㄋQ�� ��zn&��� � ND懲v���� �V�@�kW % �,�+̩�0�/̨ � � http/1.1
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� Ǖ��xW�:; ��f��y��/
�ㄋQ�� ��zn&��� �
ND懲v���� �V�@�kW
% �,�+̩�0�/̨ � � http/1.1
Requête brute (extrait)
� �� Ǖ��xW�:; ��f��y��/ �ㄋQ�� ��zn&��� � ND懲v���� �V�@�kW % �,�+̩�0�/̨ � � http/1.1 + # 3 & $ /s�e�I;0ժ��V�Ϯ��P�Z�GonH�/��# -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.889399447300359,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6486e5684e3779da77151cd618b6baa8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "7b7c21f1a4523674588b9b1169476767",
"ja4": "740c6132fd45c7071ab01222973382d4",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "7b7c21f1a4523674588b9b1169476767",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-13-11-5-43-35-10-23-51-45,29-23-24,0",
"tls_ja4_hash": "740c6132fd45c7071ab01222973382d4",
"tls_ja4": "t13d0110_7c617da1a2a5_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u01d5\ufffd\u0013\ufffdxW\u0015\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\u001d\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\u001c\ufffd\rND\ufa8b\u0004v\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u01d5\ufffd\u0013\ufffdxW\u0015\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\u001d\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\u001c\ufffd\rND\ufa8b\u0004v\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \/s\ufffde\ufffdI;0\u056a\ufffd\ufffdV\ufffd\u03ee\ufffd\ufffdP\ufffdZ\ufffdGonH\ufffd\/\ufffd\ufffd#\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u01d5\ufffd\u0013\ufffdxW\u0015\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\u001d\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\u001c\ufffd\rND\ufa8b\u0004v\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef195e1e81e7cacd415a730dd7dde15e62238259",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u01d5\ufffd\u0013\ufffdxW\u0015\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\u001d\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\u001c\ufffd\rND\ufa8b\u0004v\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"tls_ja3": "7b7c21f1a4523674588b9b1169476767",
"tls_ja4": "740c6132fd45c7071ab01222973382d4",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u01d5\ufffd\ufffdxW\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\ufffd\rND\ufa8bv\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u01d5\ufffd\u0013\ufffdxW\u0015\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\u001d\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\u001c\ufffd\rND\ufa8b\u0004v\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"tls_ja3": "7b7c21f1a4523674588b9b1169476767",
"tls_ja4": "740c6132fd45c7071ab01222973382d4",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "postgres probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u01d5\ufffd\ufffdxW\ufffd:;\t\ufffd\ufffdf\ufffd\ufffdy\ufffd\ufffd\/\n\ufffd\u310bQ\ufffd\ufffd \ufffd\ufffdzn&\ufffd\ufffd\ufffd\ufffd\rND\ufa8bv\ufffd\ufffd\ufffd\ufffd \ufffdV\ufffd@\ufffdkW\r%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1ab66ba70bef9130
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� ��yJO I '�B�=�Y�H*�G(�#�w�)bF�� 'Q���*y��^�����Y���[%Wz���fy=f� �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��yJO I
'�B�=�Y�H*�G(�#�w�)bF�� 'Q���*y��^�����Y���[%Wz���fy=f� �,�+̩�0�/̨ � � #
Requête brute (extrait)
� ��yJO I '�B�=�Y�H*�G(�#�w�)bF�� 'Q���*y��^�����Y���[%Wz���fy=f� �,�+̩�0�/̨ � � # http/1.1 - + 3 & $ ;�!��� S�1��M*�+9��������@
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.919876534304285,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38ae8551dc57ed034852603e430e87f3",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "1ab66ba70bef9130815a65e2b2fb1693",
"ja4": "422351d271b140cccc58793ad584e983",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "1ab66ba70bef9130815a65e2b2fb1693",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-13-10-16-45-11-23-5-43-51,29-23-24,0",
"tls_ja4_hash": "422351d271b140cccc58793ad584e983",
"tls_ja4": "t13d0110_d54919c84619_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyJ\u0012O\u000b\u0017I\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyJ\u0012O\u000b\u0017I\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ;\ufffd!\ufffd\ufffd\ufffd\u001eS\ufffd\u000f1\ufffd\ufffdM*\ufffd+9\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0013\ufffd@",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyJ\u0012O\u000b\u0017I\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db2fa137d6e0b9ad274b96dce5d8d182f0eb7892",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyJ\u0012O\u000b\u0017I\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "1ab66ba70bef9130815a65e2b2fb1693",
"tls_ja4": "422351d271b140cccc58793ad584e983",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd\ufffdyJOI\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdyJ\u0012O\u000b\u0017I\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003",
"tls_ja3": "1ab66ba70bef9130815a65e2b2fb1693",
"tls_ja4": "422351d271b140cccc58793ad584e983",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdyJOI\n'\ufffdB\ufffd=\ufffdY\ufffdH*\ufffdG(\ufffd#\ufffdw\ufffd)bF\ufffd\ufffd 'Q\ufffd\ufffd\ufffd*y\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd[%Wz\ufffd\ufffd\ufffdfy=f\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ce6363d214f4daf7
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� � J��;�i��H$� ���� ��KE�I���& �Nӟ�ĵL�wϾ� �{"�&�>�A ����� �,�+̩�0�/̨ � � # 3 & $ %6}7� H_�0H
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � J��;�i��H$� ���� ��KE�I���& �Nӟ�ĵL�wϾ� �{"�&�>�A
����� �,�+̩�0�/̨ � � # 3 & $ %6}7� H_�0H
Requête brute (extrait)
� � J��;�i��H$� ���� ��KE�I���& �Nӟ�ĵL�wϾ� �{"�&�>�A ����� �,�+̩�0�/̨ � � # 3 & $ %6}7� H_�0H�Ӫ����:lV&Kv�)9��* http/1.1 + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.895041047946207,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc9a038a1facebf6f077d53ce06478df",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "ce6363d214f4daf702149f78fb3ec012",
"ja4": "c85fc0191b04eaf2192bea6fdbc1661c",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "ce6363d214f4daf702149f78fb3ec012",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-51-16-43-10-13-23-11-5-45,29-23-24,0",
"tls_ja4_hash": "c85fc0191b04eaf2192bea6fdbc1661c",
"tls_ja4": "t13d0110_b95ab56e6c12_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000bJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH\u0016$\ufffd\u0002\u000b\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffdKE\ufffdI\ufffd\b\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\u001e\ufffd{\"\ufffd&\ufffd>\ufffdA\n\u0003\u0015\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 %6}\u00157\ufffd\u001eH_\ufffd0H",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000bJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH\u0016$\ufffd\u0002\u000b\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffdKE\ufffdI\ufffd\b\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\u001e\ufffd{\"\ufffd&\ufffd>\ufffdA\n\u0003\u0015\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 %6}\u00157\ufffd\u001eH_\ufffd0H\ufffd\u04ea\ufffd\ufffd\ufffd\ufffd:lV&Kv\ufffd)9\ufffd\ufffd*\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000bJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH\u0016$\ufffd\u0002\u000b\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffdKE\ufffdI\ufffd\b\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\u001e\ufffd{\"\ufffd&\ufffd>\ufffdA\n\u0003\u0015\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 %6}\u00157\ufffd\u001eH_\ufffd0H",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ed432810287da75267027e57d86648046c652b1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000bJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH\u0016$\ufffd\u0002\u000b\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffdKE\ufffdI\ufffd\b\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\u001e\ufffd{\"\ufffd&\ufffd>\ufffdA\n\u0003\u0015\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 %6}\u00157\ufffd\u001eH_\ufffd0H",
"tls_ja3": "ce6363d214f4daf702149f78fb3ec012",
"tls_ja4": "c85fc0191b04eaf2192bea6fdbc1661c",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffdJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKE\ufffdI\ufffd\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\ufffd{\"\ufffd&\ufffd>\ufffdA\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#3&$ %6}7\ufffdH_\ufffd0H",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000bJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH\u0016$\ufffd\u0002\u000b\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffdKE\ufffdI\ufffd\b\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\u001e\ufffd{\"\ufffd&\ufffd>\ufffdA\n\u0003\u0015\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 %6}\u00157\ufffd\u001eH_\ufffd0H",
"tls_ja3": "ce6363d214f4daf702149f78fb3ec012",
"tls_ja4": "c85fc0191b04eaf2192bea6fdbc1661c",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdJ\ufffd\ufffd;\ufffdi\ufffd\ufffdH$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKE\ufffdI\ufffd\ufffd\ufffd& \ufffdN\u04df\ufffd\u0135L\ufffdw\u03fe\ufffd\ufffd{\"\ufffd&\ufffd>\ufffdA\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#3&$ %6}7\ufffdH_\ufffd0H",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 326703c58f93411b
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �&|� �v����sy@��m$��^#���1!u k iO������A� z1>| (ph�Se\P{�WA� �,�+̩�0�/̨ � � 3 & $ x.=/d?eq-���:��
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&|� �v����sy@��m$��^#���1!u k iO������A� z1>| (ph�Se\P{�WA� �,�+̩�0�/̨ � � 3 & $ x.=/d?eq-���:��
Requête brute (extrait)
� �&|� �v����sy@��m$��^#���1!u k iO������A� z1>| (ph�Se\P{�WA� �,�+̩�0�/̨ � � 3 & $ x.=/d?eq-���:���*�u��*�T��/���5 http/1.1 + - #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.855074016944491,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9a4069ffb6c9ae6e5ea5b878c8e73ce9",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "326703c58f93411b1e9bf90804d5200b",
"ja4": "32e936fe1942aeae30a48cb2d506af99",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "326703c58f93411b1e9bf90804d5200b",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-16-5-13-43-45-10-35-23-11,29-23-24,0",
"tls_ja4_hash": "32e936fe1942aeae30a48cb2d506af99",
"tls_ja4": "t13d0110_6ccd24d81bb8_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&|\ufffd\u001e\ufffdv\ufffd\ufffd\ufffd\ufffd\u0002\u0002sy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!u\u0000k i\u0015O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\u0014\ufffd\u001ez1>|\u000b(ph\ufffdS\u0016e\\P{\ufffdWA\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&|\ufffd\u001e\ufffdv\ufffd\ufffd\ufffd\ufffd\u0002\u0002sy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!u\u0000k i\u0015O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\u0014\ufffd\u001ez1>|\u000b(ph\ufffdS\u0016e\\P{\ufffdWA\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffd*\ufffdu\ufffd\ufffd*\ufffdT\ufffd\ufffd\/\ufffd\ufffd\ufffd5\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&|\ufffd\u001e\ufffdv\ufffd\ufffd\ufffd\ufffd\u0002\u0002sy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!u\u0000k i\u0015O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\u0014\ufffd\u001ez1>|\u000b(ph\ufffdS\u0016e\\P{\ufffdWA\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "adefa0e9c1ad63a2fa1cc4fbf9ed6d14a38aadf6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&|\ufffd\u001e\ufffdv\ufffd\ufffd\ufffd\ufffd\u0002\u0002sy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!u\u0000k i\u0015O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\u0014\ufffd\u001ez1>|\u000b(ph\ufffdS\u0016e\\P{\ufffdWA\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"tls_ja3": "326703c58f93411b1e9bf90804d5200b",
"tls_ja4": "32e936fe1942aeae30a48cb2d506af99",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffd&|\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffdsy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!uk iO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffdz1>|(ph\ufffdSe\\P{\ufffdWA\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&|\ufffd\u001e\ufffdv\ufffd\ufffd\ufffd\ufffd\u0002\u0002sy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!u\u0000k i\u0015O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\u0014\ufffd\u001ez1>|\u000b(ph\ufffdS\u0016e\\P{\ufffdWA\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"tls_ja3": "326703c58f93411b1e9bf90804d5200b",
"tls_ja4": "32e936fe1942aeae30a48cb2d506af99",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd&|\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffdsy@\ufffd\ufffdm$\ufffd\ufffd^#\ufffd\ufffd\ufffd1!uk iO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffdz1>|(ph\ufffdSe\\P{\ufffdWA\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ x.=\/d?eq-\ufffd\ufffd\ufffd:\ufffd\ufffd",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7ef9706661210c56
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
� �o���,��EnC��#81��n H�����L� �F̟N{J�U,���� ��k����#�*��F�I �,�+̩�0�/̨ � � 3 & $ 1��
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �o���,��EnC��#81��n H�����L� �F̟N{J�U,����
��k����#�*��F�I �,�+̩�0�/̨ � � 3 & $ 1��
Requête brute (extrait)
� �o���,��EnC��#81��n H�����L� �F̟N{J�U,���� ��k����#�*��F�I �,�+̩�0�/̨ � � 3 & $ 1��\+��� �Sps�IТ&�zS�o�i�z + - http/1.1 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 241,
"payload_entropy": 5.824785733190686,
"port_category": "registered",
"org": "Google LLC",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 396982,
"country": "JP",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d42eee2d37ce6353240b0d137d3718b6542948d8",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "remoteanything",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "66a225b1f96129f4a371b28d6afdf0ff",
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33",
"ja3": "7ef9706661210c5629a7d0b41b15689a",
"ja4": "881ac7f196cf2d1ad4dbd1f6b07982b8",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "7ef9706661210c5629a7d0b41b15689a",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-5-51-10-43-45-11-13-16-35,29-23-24,0",
"tls_ja4_hash": "881ac7f196cf2d1ad4dbd1f6b07982b8",
"tls_ja4": "t13d0110_1539910e55c9_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\ufffd\u0003,\ufffd\ufffdEnC\u0005\ufffd\ufffd#81\ufffd\ufffdn\u001a\u001fH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031f\u0010N{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd\b*\ufffd\ufffdF\ufffdI\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\ufffd\u0003,\ufffd\ufffdEnC\u0005\ufffd\ufffd#81\ufffd\ufffdn\u001a\u001fH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031f\u0010N{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd\b*\ufffd\ufffdF\ufffdI\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd\\+\ufffd\ufffd\ufffd\u001f\u001b\u0015\ufffdSp\u0014s\ufffdI\u0422&\ufffd\bzS\ufffdo\ufffdi\ufffdz\u001a\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\ufffd\u0003,\ufffd\ufffdEnC\u0005\ufffd\ufffd#81\ufffd\ufffdn\u001a\u001fH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031f\u0010N{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd\b*\ufffd\ufffdF\ufffdI\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85d4a330b858dc632783d941e701f22cc67859bf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\ufffd\u0003,\ufffd\ufffdEnC\u0005\ufffd\ufffd#81\ufffd\ufffdn\u001a\u001fH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031f\u0010N{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd\b*\ufffd\ufffdF\ufffdI\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd",
"tls_ja3": "7ef9706661210c5629a7d0b41b15689a",
"tls_ja4": "881ac7f196cf2d1ad4dbd1f6b07982b8",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "\ufffd\ufffdo\ufffd\ufffd\ufffd,\ufffd\ufffdEnC\ufffd\ufffd#81\ufffd\ufffdnH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031fN{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd*\ufffd\ufffdF\ufffdI\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ 1\ufffd\ufffd",
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\ufffd\ufffd\u0003,\ufffd\ufffdEnC\u0005\ufffd\ufffd#81\ufffd\ufffdn\u001a\u001fH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031f\u0010N{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd\b*\ufffd\ufffdF\ufffdI\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd",
"tls_ja3": "7ef9706661210c5629a7d0b41b15689a",
"tls_ja4": "881ac7f196cf2d1ad4dbd1f6b07982b8",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdo\ufffd\ufffd\ufffd,\ufffd\ufffdEnC\ufffd\ufffd#81\ufffd\ufffdnH\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd \ufffdF\u031fN{J\ufffdU,\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd#\ufffd*\ufffd\ufffdF\ufffdI\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ 1\ufffd\ufffd",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|